Grandoreiro DLL Side-Loading via Legitimate Software (mingwm10/libwebp/libffi/libpng)
Detects DLL side-loading activity associated with the Grandoreiro banking trojan. The rule identifies instances where legitimate, signed software (e.g., FastStone Image Viewer, MinGW, FreeMat, AbiWord) loads known malicious DLLs (e.g., mingwm10.dll, libwebp.dll) from user-writable directories such as %TEMP% or %APPDATA%, which is a characteristic behavior of the malware.
YARA-L
