MalwareUsed by 1 actor

winhttp.dll

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Lazarus

IT 기업에서 발견된 악성 winhttp.dll 은 파일리스(Fileless) 악성코드를 메모리에 생성 ... 실제 악성 행위(자료 유출, 악성코드 생성, C2 통신 등)는 메모리에 생성된 파일리스 악성코드가 담당

via ahnlab asec blogasec.ahnlab.com

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

3 techniques

T1112Modify RegistryEvidence2

reg add "HKLM\SOFTWARE\TitanPlus" /v 1 /t REG_SZ /d "185.190.251.16:443;207.90.238.52:443;89.185.80.86:443" /f

T1543.003Windows ServiceEvidence2

the attacker then executed a PowerShell command to create a service to automatically run the exploited executable.

T1547.009Shortcut ModificationEvidence2

The PowerShell command also created a .lnk file for the executable in the devices’ startup items folder to maintain persistence through reboot.

Privilege Escalation

3 techniques

T1055Process InjectionEvidence1

IT 기업에서 발견된 악성 winhttp.dll 은 파일리스(Fileless) 악성코드를 메모리에 생성... 실제 악성 행위(자료 유출, 악성코드 생성, C2 통신 등)는 메모리에 생성된 파일리스 악성코드가 담당합니다.

T1543.003Windows ServiceEvidence2

the attacker then executed a PowerShell command to create a service to automatically run the exploited executable.

T1547.009Shortcut ModificationEvidence2

The PowerShell command also created a .lnk file for the executable in the devices’ startup items folder to maintain persistence through reboot.

Stealth

2 techniques

T1036MasqueradingEvidence1

악성 DLL 은 정상 EXE 가 실행하는 정상 DLL 과 똑같은 파일명으로 위장한 것이 특징입니다.

T1055Process InjectionEvidence1

Defense Impairment

1 technique

T1112Modify RegistryEvidence2

reg add "HKLM\SOFTWARE\TitanPlus" /v 1 /t REG_SZ /d "185.190.251.16:443;207.90.238.52:443;89.185.80.86:443" /f

Discovery

1 technique

T1046Network Service DiscoveryEvidence2

the Sophos MDR team observed the OneDriveStandaloneUpdater.exe process conducting scanning with the SMB protocol to map online hosts within the customers’ environment. The threat actor also scanned for Remote Desktop Protocol and Windows Remote Management (WinRM) hosts

Command and Control

2 techniques

T1105Ingress Tool TransferEvidence1

The Java code then ran a series of PowerShell commands that downloaded a 7zip archive and the 7zip archiving utility.

T1573Encrypted ChannelEvidence1

Using the unsigned OpenSSL toolkit drivers, the OneDriveStandaloneUpdate process made encrypted command-and-control connections to a set of remote hosts.

Other

1 technique

T1562Impair DefensesEvidence2

In one incident, Sophos MDR observed the threat actor using the backdoor to uninstall local multifactor authentication integration on the target device. In another, the threat actor unsuccessfully attempted to uninstall the Sophos Endpoint Agent

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

ahnlab asec blogNews

Aug 14, 2026

A malicious DLL that implements DLL side-loading and reconstructs/launches a fileless payload in memory, which then handles C2, data theft, and payload generation.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

winhttp.dll

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Lazarus

via ahnlab asec blogasec.ahnlab.com

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

3 techniques

T1112Modify RegistryEvidence2

reg add "HKLM\SOFTWARE\TitanPlus" /v 1 /t REG_SZ /d "185.190.251.16:443;207.90.238.52:443;89.185.80.86:443" /f

T1543.003Windows ServiceEvidence2

the attacker then executed a PowerShell command to create a service to automatically run the exploited executable.

T1547.009Shortcut ModificationEvidence2

The PowerShell command also created a .lnk file for the executable in the devices’ startup items folder to maintain persistence through reboot.

Privilege Escalation

3 techniques

T1055Process InjectionEvidence1

T1543.003Windows ServiceEvidence2

the attacker then executed a PowerShell command to create a service to automatically run the exploited executable.

T1547.009Shortcut ModificationEvidence2

The PowerShell command also created a .lnk file for the executable in the devices’ startup items folder to maintain persistence through reboot.

Stealth

2 techniques

T1036MasqueradingEvidence1

악성 DLL 은 정상 EXE 가 실행하는 정상 DLL 과 똑같은 파일명으로 위장한 것이 특징입니다.

T1055Process InjectionEvidence1

Defense Impairment

1 technique

T1112Modify RegistryEvidence2

reg add "HKLM\SOFTWARE\TitanPlus" /v 1 /t REG_SZ /d "185.190.251.16:443;207.90.238.52:443;89.185.80.86:443" /f

Discovery

1 technique

T1046Network Service DiscoveryEvidence2

Command and Control

2 techniques

T1105Ingress Tool TransferEvidence1

The Java code then ran a series of PowerShell commands that downloaded a 7zip archive and the 7zip archiving utility.

T1573Encrypted ChannelEvidence1

Using the unsigned OpenSSL toolkit drivers, the OneDriveStandaloneUpdate process made encrypted command-and-control connections to a set of remote hosts.

Other

1 technique

T1562Impair DefensesEvidence2

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

ahnlab asec blogNews

Aug 14, 2026

A malicious DLL that implements DLL side-loading and reconstructs/launches a fileless payload in memory, which then handles C2, data theft, and payload generation.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.