Hijack Execution Flow: DLL Side-Loading

APT19 launched an HTTP malware variant and a Port 22 malware variant using a legitimate executable that loaded the malicious DLL.^[27]

APT3 has been known to side load DLLs with a valid version of Chrome with one of their tools.^[29][10]

APT32 ran legitimately-signed executables from Symantec and McAfee which load a malicious DLL. The group also side-loads its backdoor by dropping a library and a legitimate, signed executable (AcroTranscoder).^[20][23][30]

APT41 used legitimate executables to perform DLL side-loading of their malware.^[34]

BADNEWS typically loads its DLL file into a legitimate signed Java or VMware executable.^[3][4]

DLL side-loading has been used to execute BBSRAT through a legitimate Citrix executable, ssonsvr.exe. The Citrix executable was dropped along with BBSRAT by the dropper.^[9]

BRONZE BUTLER has used legitimate applications to side-load malicious DLLs.^[36]

Denis exploits a security vulnerability to load a fake DLL and execute its code.^[20]

FinFisher uses DLL side-loading to load malicious programs.^[6][7]

A gh0st RAT variant has used DLL side-loading.^[5]

Goopy has the ability to side-load malicious DLLs with legitimate applications from Kaspersky, Microsoft, and Google.^[23]

HTTPBrowser has used DLL side-loading.^[11]

HyperBro has used a legitimate application to sideload a DLL to decrypt, decompress, and run a payload.^[21]

menuPass has used DLL side-loading to launch versions of Mimikatz and PwDump6 as well as UPPERCUT.^[13][28]

Metamorfo has side-loaded its malicious DLL file.^[22]

Naikon has used DLL side-loading to load malicious DLL's into legitimate executables.^[35]

OwaAuth has been loaded onto Exchange servers and disguised as an ISAPI filter (DLL file). The IIS w3wp.exe process then loads the malicious DLL.^[11]

A Patchwork .dll that contains BADNEWS is loaded and executed using DLL side-loading.^[24]

PlugX has used DLL side-loading to evade anti-virus.^{[10][11][12][13][14]}

Sakula uses DLL side-loading, typically using a digitally signed sample of Kaspersky Anti-Virus (AV) 6.0 for Windows Workstations or McAfee's Outlook Scan About Box to load malicious DLL files.^[8]

Soft Cell used DLL side-loading to covertly load PoisonIvy into memory on the victim machine.^[33]

During the T9000 installation process, it drops a copy of the legitimate Microsoft binary igfxtray.exe. The executable contains a side-loading weakness which is used to load a portion of the malware.^[17]

Threat Group-3390 has used DLL side-loading, including by using legitimate Kaspersky antivirus variants in which the DLL acts as a stub loader that loads and executes the shell code.^{[11][25][26][21]}

Tropic Trooper has been known to side-load DLLs using a valid version of a Windows Address Book and Windows Defender executable with one of their tools.^[31][32]

Wingbird side loads a malicious file, sspisrv.dll, in part of a spoofed lssas.exe service.^[15][16]

ZeroT has used DLL side-loading to load malicious payloads.^[18][19]

Use the program sxstrace.exe that is included with Windows along with manual inspection to check manifest files for side-loading vulnerabilities in software.

Install software in write-protected locations.

Update software regularly to include patches that fix DLL side-loading vulnerabilities.