SloppyRAT Reflective DLL Load via hostfxr.dll and DLLMemLoader User-Agent

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•3

Detects the execution of Python processes where command line arguments indicate the use of the DLLMemLoader agent or related indicators like 'hostfxr' or specific hex strings. This activity is often associated with the loading of malicious DLLs or secondary stages in an attack chain.