Procedure examples

BLINDINGCAN has loaded and executed DLLs in memory during runtime on a victim machine.

Bumblebee can use `LoadLibrary` to attempt to execute GdiPlus.dll.

Stuxnet calls LoadLibrary then executes exports from a DLL.

RotaJakiro uses dynamically linked shared libraries (`.so` files) to execute additional functionality using `dlopen()` and `dlsym()`.

VersaMem relied on the Java Instrumentation API and Javassist to dynamically modify Java code existing in memory.

BOOSTWRITE has used the DWriteCreateFactory() function to load additional modules.

LightSpy's main executable and module `.dylib` binaries are loaded using a combination of `dlopen()` to load the library, `_objc_getClass()` to retrieve the class definition, and `_objec_msgSend()` to invoke/execute the specified method in the loaded class.

PUNCHBUGGY can load a DLL using the LoadLibrary API.

DarkWatchman can load DLLs.

FoggyWeb's loader can call the load() function to load the FoggyWeb dll into an Application Domain on a compromised AD FS server.

Hydraq creates a backdoor through which remote attackers can load and call DLL functions.

Metamorfo had used AutoIt to load and execute the DLL payload.

PipeMon has used call to LoadLibrary to load its installer. PipeMon loads its modules using reflective loading or custom shellcode.

gh0st RAT can load DLLs into memory.

Attor's dispatcher can execute additional plugins by loading the respective DLLs.

For network communications, OSX_OCEANLOTUS.D loads a dynamic library (`.dylib` file) using `dlopen()` and obtains a function pointer to execute within that shared library using `dlsym()`.

TajMahal has the ability to inject the LoadLibrary call template DLL into running processes.

Ebury is executed through hooking the keyutils.so file used by legitimate versions of `OpenSSH` and `libcurl`.

KillDisk loads and executes functions from a DLL.

Astaroth uses the LoadLibraryExW() function to load additional modules.

Dtrack contains a function that calls LoadLibrary and GetProcAddress.