Spoofed dnsapi.dll/ws2_32.dll Loaded Outside System32 (NeedyMantis)
Detects the NeedyMantis malware component loading configuration and communications modules (specifically dnsapi.dll or ws2_32.dll) from a non-standard system directory. This behavior is indicative of DLL hijacking or side-loading, where a malicious library is substituted for a legitimate Windows system library to facilitate command and control or malicious execution.
YARA-L
