Shared Modules

Astaroth uses the LoadLibraryExW() function to load additional modules. ^[6]

Attor's dispatcher can execute additional plugins by loading the respective DLLs.^[7]

BLINDINGCAN has loaded and executed DLLs in memory during runtime on a victim machine.^[8]

BOOSTWRITE has used the DWriteCreateFactory() function to load additional modules.^[9]

Bumblebee can use LoadLibrary to attempt to execute GdiPlus.dll.^[10]

DarkWatchman can load DLLs.^[11]

Dtrack contains a function that calls LoadLibrary and GetProcAddress.^[12]

Ebury is executed through hooking the keyutils.so file used by legitimate versions of OpenSSH and libcurl.^[13]

FoggyWeb's loader can call the load() function to load the FoggyWeb dll into an Application Domain on a compromised AD FS server.^[14]

gh0st RAT can load DLLs into memory.^[15]

Hydraq creates a backdoor through which remote attackers can load and call DLL functions.^[16][17]

KillDisk loads and executes functions from a DLL.^[18]

LightSpy's main executable and module .dylib binaries are loaded using a combination of dlopen() to load the library, _objc_getClass() to retrieve the class definition, and _objec_msgSend() to invoke/execute the specified method in the loaded class.^[19]

Metamorfo had used AutoIt to load and execute the DLL payload.^[20]

Mustang Panda has leveraged LoadLibrary to load DLLs.^[21]

For network communications, OSX_OCEANLOTUS.D loads a dynamic library (.dylib file) using dlopen() and obtains a function pointer to execute within that shared library using dlsym().^[4]

PipeMon has used call to LoadLibrary to load its installer. PipeMon loads its modules using reflective loading or custom shellcode.^[22]

PUNCHBUGGY can load a DLL using the LoadLibrary API.^[23]

RotaJakiro uses dynamically linked shared libraries (.so files) to execute additional functionality using dlopen() and dlsym().^[3]

Stuxnet calls LoadLibrary then executes exports from a DLL.^[24]

TajMahal has the ability to inject the LoadLibrary call template DLL into running processes.^[25]

VersaMem relied on the Java Instrumentation API and Javassist to dynamically modify Java code existing in memory.^[26]

Identify and block potentially malicious software executed through this technique by using application control tools capable of preventing unknown modules from being loaded.