NeedyMantis encrypted archive payload (WinSparkle/libcurl bundles)

Ibrahim Saud@tektrix

•updated 7 days ago•0•0•0

Detects specific malicious archive payloads associated with NeedyMantis that contain a second-stage loader and spoofed system DLLs (e.g., dnsapi.dll, ws2_32.dll, msvcrt140.dll). These archives utilize XOR encoding or RtlDecompressBuffer packing and are designed for DLL sideloading.