SparroWocky Trident Loader DLL Side-Loading Artifacts

Ibrahim Saud@tektrix

•updated 23 days ago•0•0•4

Detects indicators of the SparroWocky Trident loader, including specific side-loaded DLLs (winfsp-x64.dll, DukeQt.dll), encrypted payload files with custom magic headers, persistence mechanisms such as specific service names and registry keys, inter-process communication objects (mutexes, events, shared memory), and named pipes used for C2 communication.