SparroWocky backdoor issuing commands and file move/delete via loader

Ankit Mehta@Secvyn

•updated Sep 17, 2026•0•0•3

Detects process executions, file deletions, renames, and movements initiated by known SparroWocky malware files or suspicious DLLs (winfsp-x64.dll, DukeQt.dll). This monitors malicious lifecycle activity on endpoints.