12 KB Backdoor Masquerades as Realtek Software and Hides C2 in Windows Whitespace

A compact, custom-built Windows backdoor that impersonates Realtek software, persists through WMI, and conceals its command-and-control address inside what appears to be an almost empty desktop.ini file.

At just 12,288 bytes, the x64 implant was observed on a single domain-joined Windows 7 SP1 workstation, a low-prevalence footprint that researchers assess may indicate selective targeting rather than a failed commodity campaign.

Its __EventFilter monitors Win32_LocalTime and triggers at 19:50, functioning as a daily post-reboot timer rather than a conventional boot-persistence mechanism.

The consumer executes the payload from a path designed to resemble legitimate software, using the shortened Progra~1 form.

The backdoor’s most distinctive feature is its C2 configuration mechanism. Rather than embedding a domain in plaintext, encryption, or an encoded blob, it reads C:\ProgramData\desktop.ini and counts trailing UTF-16LE spaces on successive lines.

Each count maps directly to an ASCII character. Ten whitespace-only lines reconstruct the hostname diagrtrack, after which the malware appends a hard-coded .com suffix to produce diagrtrack.com.

The method abuses a legitimate Windows shell configuration format. The implant skips the first 174 bytes of a standard desktop.ini header, including the familiar LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21781 entry, then interprets the remaining whitespace as unary-encoded data.

Gen Researchers said that, the malware uses the filename RtkNGUI64.exe, matching the legitimate Realtek audio control panel process name, and is launched through a WMI permanent event subscription named “Realtek.”

12 KB Backdoor Mimics

In the recovered configuration, space counts of 100, 105, 97, 103, 114, 116, 114, 97, 99, and 107 decode to “diagrtrack.” The domain itself typosquats Microsoft’s DiagTrack telemetry service, adding another layer of environmental camouflage.

An attempt to leave no constant for a scanner to key on, and it is not: it is zlib’s DYNAMIC_CRC_TABLE build option, copied in whole. 

The binary avoids several common static-analysis indicators. It has no packer, encrypted strings, import hashing, anti-debugging logic, or C runtime dependency.

Instead, it imports 48 functions from Windows libraries including KERNEL32, WININET, WS2_32, IPHLPAPI, SHLWAPI, and ADVAPI32.

It also constructs sensitive strings in fragments; for example, desktop.ini is assembled from separate \DESKTOP. and ini literals, preventing simple string searches from locating the full filename.

For victim identification, the malware calculates a CRC-32 over the concatenated USERNAME, USERDOMAIN, and COMPUTERNAME values, formats the result as an eight-character identifier, and reuses it as a mutex name.

Before sending HTTP traffic, it performs an ICMP echo request containing that identifier. Only a successful ping causes it to send a POST request to /version/check.php, using a hard-coded Chrome 78 user-agent and a beacon body in the form a=<id>&r=none.

The operator’s tasking capability is deliberately narrow but sufficient for hands-on-keyboard activity. The backdoor supports system commands via cmd.exe, put commands to write base64-encoded files, and time commands to alter its default five-second polling interval.

Its file-drop routine briefly writes altered bytes in place of the MZ PE header before restoring them, potentially reducing the effectiveness of file-creation and rename-time scanning.

The C2 domain was registered in July 2020, while the payload was compiled on December 2, 2020. DNS records disappeared in March 2021 and the domain expired later that year, yet the WMI persistence and configuration remained on the endpoint.

Researchers recommend hunting for Win32_LocalTime-based WMI subscriptions, suspicious C:\ProgramData\desktop.ini files, and UTF-16 desktop.ini content that contains only whitespace, carriage returns, and line feeds beyond the standard 174-byte header.

Indicators of Compromise

Indicator	Type
diagrtrack{.}com	C2 domain (expired, no longer resolves)
d411d93f358128c77aed0be91365b18cfb7575ecd188d22a216cbaeaa51c5e11	Backdoor, RtkNGUI64.exe
1cc5a4be7f2e41086b53e698b487e43426e5e572bc99e5de62eada9baf83bdcd	Whitespace-encoded config
C:\Program Files\Realtek\Audio\RtkNGUI64.exe	Fake install path

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now