Rule Info
Name
APT_MAL_DLL_Launcher_May26
Author
MalGamy
Description
Detects a masquerading DLL launcher that executes from a TLS callback to download a second-stage payload via bitsadmin and run it inside a legitimate Windows process for stealthy persistence, seen being used by Bitter APT group
Score
80
Date
2026-05-01
Minimum Yara
3.5.0
Rule Hash
c1940616d8b24e6bc40233403dc17099
Tags
['EXE', 'T1197', 'FILE', 'MAL', 'APT', 'G1002']
Required Modules
[]
Virustotal Matches
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
0
Suspicious (< 10 engines)
2
Clean (0 engines)
0
Rule Matches
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR