SparroWocky loader creates .dat payload after DLL side-load

Ankit Mehta@Secvyn

•updated Sep 17, 2026•1•0•2

Detects a process loading known malicious DLLs (winfsp-x64.dll or DukeQt.dll) used by the FamousSparrow threat actor, followed by the creation or modification of a .dat file in the same process context. This pattern is indicative of the reflective loading of a backdoor payload without leaving the secondary binary on disk.