MLTBackdoor DLL Execution via Rundll32

Thiru N@Iamthiru

•updated Jun 9, 2026•2•0•6

Detects the execution of the initial stage DLL payload (endpointdlp.dll) via rundll32.exe calling a specific ordinal (#2) to decrypt and load the final MLTBackdoor payload. This behavior is highly specific to the MLTBackdoor threat.