Loading malware…
DodgeBox is a reflective DLL loader written in C and associated in the reporting with APT41 (also referenced as Wicked Panda). It has been described as a new variant of StealthVector, also referred to as DUSTPAN, and has been observed in multi-stage intrusion chains using DLL sideloading with legitimate executables such as taskhost.exe. In the reported chain, a malicious DodgeBox DLL decrypts a second-stage payload from an encrypted DAT file, including sbiedll.dat, and loads the MoonWalk backdoor directly in memory.
Reported DodgeBox capabilities include reflective loading, in-memory execution, sandbox detection, dynamic API resolution using obfuscated hashes, and use of a salted FNV-1a hashing function to hide DLL and function names such as ntdll and LdrLoadDll. It checks for the SbieDll module to detect Sandboxie and, if found, halts execution by calling Sleep(INFINITE). It resolves APIs including NtAllocateVirtualMemory and allocates memory with PAGE_READWRITE permissions. Reporting also states that DodgeBox decrypts and reflectively loads embedded plugins named C2 and Utility, and that the C2 plugin uses a custom encrypted protocol.
DodgeBox has also been specifically reported as implementing call stack spoofing to evade antivirus and EDR products that rely on stack telemetry. In the described implementation, it decrypts strings at runtime using a hard-coded AES key, obtains a handle to kernelbase.dll via LdrGetDllHandle, scans the .text section for JOP gadgets, parses .pdata unwind metadata to identify suitable gadgets, and selects from 56 discovered gadgets using GetTickCount64-derived timing. It then resolves RtlUserThreadStart and BaseThreadInitThunk, adjusts their return addresses on the stack, and invokes NtCreateFile in a way intended to present a legitimate-looking call chain to defenders.
DodgeBox is closely linked in the content to MoonWalk, a backdoor it loads. The broader intrusion activity described in the source material targeted U.S. state government networks and Taiwanese media in campaigns active from May 2021 to February 2022. Separate reporting also notes that newer evasive malware families including DodgeBox and MoonWalk were deployed via DLL sideloading, and that later tooling such as Amaranth Loader shared similarities with DodgeBox, DUSTPAN/StealthVector, and DUSTTRAP in activity assessed as linked to the APT41 ecosystem.
A reported sample hash for DodgeBox is SHA-256 33fd050760e251ab932e5ca4311b494ef72cee157b20537ce773420845302e49.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This attack included several stages including DodgeBox, a reflective DLL loader written in C, showcases similarities to StealthVector in terms of concept but incorporates significant improvements in its implementation.
8 distinct techniques documented for this family, organized by ATT&CK tactic.
The malicious process retrieves a handle to kernelbase.dll via a function call to LdrGetDllHandle... The binary extracts the address of the RtlUserThreadStart function by calling the LdrGetProcedureAddressEx method... Figure 19 reveals the instruction used to jump to the NtCreateFile function.
It dynamically resolves API functions using obfuscated hashes to evade detection... It employs FNV-1a hashing to obscure strings like DLL and function names.
The purpose of the technique is to construct a fake call stack that mimics a legitimate call stack in order to hide suspicious activity that might be detected by EDR or other security software.
MalwareMain uses the resolved API NtAllocateVirtualMemory to allocate memory in the process space. This allocated memory could be used for malicious purposes such as: Injecting malicious code. Executing a payload from memory.
The malicious DLL, DodgeBox, serves as a loader and is responsible for decrypting a second stage payload from an encrypted DAT file (sbiedll.dat), The decrypted payload, MoonWalk functions as a backdoor.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a tool associated with APT41 and similar to Amaranth Loader (suggesting shared tooling/resources).
Referenced as an APT41-associated tool similar to Amaranth Loader; specific functionality not described in the provided content.
Reflective DLL loader used to decrypt and load the second-stage MoonWalk payload from an encrypted DAT file. It uses DLL sideloading, sandbox detection, dynamic API resolution, obfuscated hashing, and memory allocation to execute payloads in memory while evading analysis.
DodgeBox is malware used by APT41 that implements call stack spoofing to hide suspicious activity from antivirus and EDR products. In the described sample, it decrypts strings at runtime with AES, locates JOP gadgets in kernelbase.dll, constructs a fake call stack, and invokes NtCreateFile in a way that obscures the true origin of the call.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.