value:  BRONZE BUTLER has used legitimate applications to side-load malicious DLLs. ;; Chimera has used side loading to place malicious DLLs in memory. ;; Denis exploits a security vulnerability to load a fake DLL and execute its code. ;; Egregor has used DLL side-loading to execute its payload. ;; FinFisher uses DLL side-loading to load malicious programs. ;; GALLIUM used DLL side-loading to covertly load PoisonIvy into memory on the victim machine. ;; A gh0st RAT variant has used DLL side-loading. ;; Goopy has the ability to side-load malicious DLLs with legitimate applications from Kaspersky Microsoft and Google. ;; Higaisa’s JavaScript file used a legitimate Microsoft Office 2007 package to side-load the OINFO12.OCX dynamic link library. ;; HTTPBrowser has used DLL side-loading. ;; HyperBro has used a legitimate application to sideload a DLL to decrypt decompress and run a payload. ;; Javali can use DLL side-loading to load malicious DLLs into legitimate executables. ;; LookBack side loads its communications module as a DLL into the libcurl.dll loader. ;; menuPass has used DLL side-loading to launch versions of Mimikatz and PwDump6 as well as UPPERCUT. ;; Metamorfo has side-loaded its malicious DLL file. ;; Mustang Panda has used a legitimately signed executable to execute a malicious payload within a DLL file. ;; Naikon has used DLL side-loading to load malicious DLL's into legitimate executables. ;; OwaAuth has been loaded onto Exchange servers and disguised as an ISAPI filter (DLL file). The IIS w3wp.exe process then loads the malicious DLL. ;; A Patchwork .dll that contains BADNEWS is loaded and executed using DLL side-loading. ;; PlugX has used DLL side-loading to evade anti-virus. ;; Sakula uses DLL side-loading typically using a digitally signed sample of Kaspersky Anti-Virus (AV) 6.0 for Windows Workstations or McAfee's Outlook Scan About Box to load malicious DLL files. ;; Sidewinder has used DLL side-loading to drop and execute malicious payloads including the hijacking of the legitimate Windows application file rekeywiz.exe. ;; During the T9000 installation process it drops a copy of the legitimate Microsoft binary igfxtray.exe. The executable contains a side-loading weakness which is used to load a portion of the malware. ;; Threat Group-3390 has used DLL side-loading including by using legitimate Kaspersky antivirus variants in which the DLL acts as a stub loader that loads and executes the shell code. ;; Tropic Trooper has been known to side-load DLLs using a valid version of a Windows Address Book and Windows Defender executable with one of their tools. ;; Waterbear has used DLL side loading to import and load a malicious DLL loader. ;; Wingbird side loads a malicious file sspisrv.dll in part of a spoofed lssas.exe service. ;; ZeroT has used DLL side-loading to load malicious payloads.
name: Hijack Execution Flow: Dll Side