共享模块

Astaroth uses the LoadLibraryExW() function to load additional modules. ^[1]

Attor's dispatcher can execute additional plugins by loading the respective DLLs.^[2]

BLINDINGCAN has loaded and executed DLLs in memory during runtime on a victim machine.^[3]

BOOSTWRITE has used the DWriteCreateFactory() function to load additional modules.^[4]

Bumblebee can use LoadLibrary to attempt to execute GdiPlus.dll.^[5]

DarkWatchman can load DLLs.^[6]

Dtrack contains a function that calls LoadLibrary and GetProcAddress.^[7]

Ebury is executed through hooking the keyutils.so file used by legitimate versions of OpenSSH and libcurl.^[8]

FoggyWeb's loader can call the load() function to load the FoggyWeb dll into an Application Domain on a compromised AD FS server.^[9]

gh0st RAT can load DLLs into memory.^[10]

Hydraq creates a backdoor through which remote attackers can load and call DLL functions.^[11][12]

KillDisk loads and executes functions from a DLL.^[13]

Metamorfo had used AutoIt to load and execute the DLL payload.^[14]

For network communications, OSX_OCEANLOTUS.D loads a dynamic library (.dylib file) using dlopen() and obtains a function pointer to execute within that shared library using dlsym().^[15]

PipeMon has used call to LoadLibrary to load its installer. PipeMon loads its modules using reflective loading or custom shellcode.^[16]

PUNCHBUGGY can load a DLL using the LoadLibrary API.^[17]

RotaJakiro uses dynamically linked shared libraries (.so files) to execute additional functionality using dlopen() and dlsym().^[18]

Stuxnet calls LoadLibrary then executes exports from a DLL.^[19]

TajMahal has the ability to inject the LoadLibrary call template DLL into running processes.^[20]

VersaMem relied on the Java Instrumentation API and Javassist to dynamically modify Java code existing in memory.^[21]

Identify and block potentially malicious software executed through this technique by using application control tools capable of preventing unknown modules from being loaded.