Grandoreiro DLL side-loading via legitimate software binaries (mingwm10/libwebp/libffi-6/libpng15)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•2

Detects DLL side-loading behaviors associated with the Grandoreiro banking trojan. The rule identifies malicious DLLs compiled with Delphi/Embarcadero, utilizing sgcWebSockets for C2 communication via WebRTC, and including specific anti-analysis and banking-related strings, often executed via legitimate software binaries.