Shared Modules

Astaroth uses the LoadLibraryExW() function to load additional modules. ^[6]

Attor's dispatcher can execute additional plugins by loading the respective DLLs.^[7]

BLINDINGCAN has loaded and executed DLLs in memory during runtime on a victim machine.^[8]

BOOSTWRITE has used the DWriteCreateFactory() function to load additional modules.^[9]

Bumblebee can use LoadLibrary to attempt to execute GdiPlus.dll.^[10]

DarkWatchman can load DLLs.^[11]

Dtrack contains a function that calls LoadLibrary and GetProcAddress.^[12]

FoggyWeb's loader can call the load() function to load the FoggyWeb dll into an Application Domain on a compromised AD FS server.^[13]

gh0st RAT can load DLLs into memory.^[14]

Hydraq creates a backdoor through which remote attackers can load and call DLL functions.^[15][16]

KillDisk loads and executes functions from a DLL.^[17]

Metamorfo had used AutoIt to load and execute the DLL payload.^[18]

For network communications, OSX_OCEANLOTUS.D loads a dynamic library (.dylib file) using dlopen() and obtains a function pointer to execute within that shared library using dlsym().^[4]

PipeMon has used call to LoadLibrary to load its installer. PipeMon loads its modules using reflective loading or custom shellcode.^[19]

PUNCHBUGGY can load a DLL using the LoadLibrary API.^[20]

RotaJakiro uses dynamically linked shared libraries (.so files) to execute additional functionality using dlopen() and dlsym().^[3]

Stuxnet calls LoadLibrary then executes exports from a DLL.^[21]

TajMahal has the ability to inject the LoadLibrary call template DLL into running processes.^[22]

Identify and block potentially malicious software executed through this technique by using application control tools capable of preventing unknown modules from being loaded.