SparroWocky Loader Execution Preceding Network Config Discovery

Ankit Mehta@Secvyn

•updated Sep 17, 2026•0•0•2

Detects the presence of known artifacts associated with the SparroWocky loader and backdoor, specifically identifying the file names 'winfsp-x64.dll' and 'DukeQt.dll', or files matching known SHA1 hashes of SparroWocky samples. The presence of these files on a host is a strong indicator of compromise.