Hijack Execution Flow: DLL Side-Loading

APT19 launched an HTTP malware variant and a Port 22 malware variant using a legitimate executable that loaded the malicious DLL.^[2]

APT3 has been known to side load DLLs with a valid version of Chrome with one of their tools.^[3][4]

APT32 ran legitimately-signed executables from Symantec and McAfee which load a malicious DLL. The group also side-loads its backdoor by dropping a library and a legitimate, signed executable (AcroTranscoder).^[5][6][7]

APT41 used legitimate executables to perform DLL side-loading of their malware.^[8]

BADNEWS typically loads its DLL file into a legitimate signed Java or VMware executable.^[9][10]

DLL side-loading has been used to execute BBSRAT through a legitimate Citrix executable, ssonsvr.exe. The Citrix executable was dropped along with BBSRAT by the dropper.^[11]

BlackTech has used DLL side loading by giving DLLs hardcoded names and placing them in searched directories.^[12]

BRONZE BUTLER has used legitimate applications to side-load malicious DLLs.^[13]

Chimera has used side loading to place malicious DLLs in memory.^[14]

Clambling can store a file named mpsvc.dll, which opens a malicious mpsvc.mui file, in the same folder as the legitimate Microsoft executable MsMpEng.exe to gain execution.^[15][16]

Denis exploits a security vulnerability to load a fake DLL and execute its code.^[5]

Ecipekac can abuse the legitimate application policytool.exe to load a malicious DLL.^[17]

Egregor has used DLL side-loading to execute its payload.^[18]

FinFisher uses DLL side-loading to load malicious programs.^[19][20]

GALLIUM used DLL side-loading to covertly load PoisonIvy into memory on the victim machine.^[21]

A gh0st RAT variant has used DLL side-loading.^[22]

Goopy has the ability to side-load malicious DLLs with legitimate applications from Kaspersky, Microsoft, and Google.^[6]

Higaisa’s JavaScript file used a legitimate Microsoft Office 2007 package to side-load the OINFO12.OCX dynamic link library.^[23]

HTTPBrowser has used DLL side-loading.^[24]

HyperBro has used a legitimate application to sideload a DLL to decrypt, decompress, and run a payload.^[25][26]

Javali can use DLL side-loading to load malicious DLLs into legitimate executables.^[27]

Kerrdown can use DLL side-loading to load malicious DLLs.^[28]

Lazarus Group has replaced win_fw.dll, an internal component that is executed during IDA Pro installation, with a malicious DLL to download and execute a payload.^[29]

LookBack side loads its communications module as a DLL into the libcurl.dll loader.^[30]

menuPass has used DLL side-loading to launch versions of Mimikatz and PwDump6 as well as UPPERCUT.^[31][32][33]

Metamorfo has side-loaded its malicious DLL file.^[34][35][36]

Mustang Panda has used a legitimately signed executable to execute a malicious payload within a DLL file.^[37][38][39]

Naikon has used DLL side-loading to load malicious DLL's into legitimate executables.^[40]

Nebulae can use DLL side-loading to gain execution.^[41]

Pandora can use DLL side-loading to execute malicious payloads.^[26]

A Patchwork .dll that contains BADNEWS is loaded and executed using DLL side-loading.^[42]

PlugX has used DLL side-loading to evade anti-virus.^{[4][24][43][31][44][15][45]}

RainyDay can use side-loading to run malicious executables.^[41]

RCSession can be installed via DLL side-loading.^[46][15][45]

Sakula uses DLL side-loading, typically using a digitally signed sample of Kaspersky Anti-Virus (AV) 6.0 for Windows Workstations or McAfee's Outlook Scan About Box to load malicious DLL files.^[47]

Sidewinder has used DLL side-loading to drop and execute malicious payloads including the hijacking of the legitimate Windows application file rekeywiz.exe.^[48]

SysUpdate can load DLLs through vulnerable legitimate executables.^[26]

During the T9000 installation process, it drops a copy of the legitimate Microsoft binary igfxtray.exe. The executable contains a side-loading weakness which is used to load a portion of the malware.^[49]

Threat Group-3390 has used DLL side-loading, including by using legitimate Kaspersky antivirus variants in which the DLL acts as a stub loader that loads and executes the shell code.^{[24][50][51][25]}

Tropic Trooper has been known to side-load DLLs using a valid version of a Windows Address Book and Windows Defender executable with one of their tools.^[52][53]

Waterbear has used DLL side loading to import and load a malicious DLL loader.^[12]

Wingbird side loads a malicious file, sspisrv.dll, in part of a spoofed lssas.exe service.^[54][55]

ZeroT has used DLL side-loading to load malicious payloads.^[56][57]

When possible, include hash values in manifest files to help prevent side-loading of malicious libraries.^[1]

Update software regularly to include patches that fix DLL side-loading vulnerabilities.