Loading malware…
DodgeBox is a Windows malware loader associated with APT41, also tracked as Wicked Panda and BRONZE ATLAS. It has been used in espionage-oriented intrusion chains targeting organizations including U.S. state government networks and Taiwanese media, and is closely associated with related tooling such as DUSTPAN, StealthVector, DUSTTRAP, and the MoonWalk backdoor. Reporting describes DodgeBox as a reflective DLL loader written in C and, in some usage, as a newer StealthVector variant designated DodgeBox.
DodgeBox is used to execute second-stage payloads in memory while minimizing forensic visibility. It has been observed in DLL sideloading chains that abuse legitimate executables to launch the malicious loader, after which it decrypts an encrypted payload and reflectively loads it without conventional on-disk execution. In documented intrusion chains, DodgeBox loads MoonWalk, a backdoor that supports remote command execution and persistence. DodgeBox has also been described as decrypting and reflectively loading embedded plugins, including command-and-control and utility components.
The malware emphasizes defense evasion. Observed techniques include sandbox detection, dynamic API resolution through obfuscated hashing, runtime string decryption, and memory allocation via native Windows APIs to support memory-resident execution. DodgeBox has also been reported to implement call stack spoofing to mislead antivirus and EDR products that rely on stack telemetry, constructing a legitimate-looking thread call chain before invoking sensitive native APIs. Additional analysis notes use of hashed identifiers and gadget selection logic to obscure execution flow and frustrate analysis.
DodgeBox is part of a broader APT41 tradecraft pattern centered on stealthy post-compromise execution, DLL sideloading, and in-memory loading of follow-on implants for long-term intelligence collection. Similarities between DodgeBox and later loaders linked to the APT41 ecosystem have been cited as evidence of shared development practices and operational lineage.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
BRONZE ATLAS ... Tools ... Acehash, CCleaner v5.33 backdoor, ChinaChopper, Cobalt Strike, Dicey MSDN, Dodgebox, DUSTPAN, ForkPlayground, HUC Proxy Malware (Htran)
8 distinct techniques documented for this family, organized by ATT&CK tactic.
The malicious process retrieves a handle to kernelbase.dll via a function call to LdrGetDllHandle... The binary extracts the address of the RtlUserThreadStart function by calling the LdrGetProcedureAddressEx method... Figure 19 reveals the instruction used to jump to the NtCreateFile function.
It dynamically resolves API functions using obfuscated hashes to evade detection... It employs FNV-1a hashing to obscure strings like DLL and function names.
The purpose of the technique is to construct a fake call stack that mimics a legitimate call stack in order to hide suspicious activity that might be detected by EDR or other security software.
MalwareMain uses the resolved API NtAllocateVirtualMemory to allocate memory in the process space. This allocated memory could be used for malicious purposes such as: Injecting malicious code. Executing a payload from memory.
The malicious DLL, DodgeBox, serves as a loader and is responsible for decrypting a second stage payload from an encrypted DAT file (sbiedll.dat), The decrypted payload, MoonWalk functions as a backdoor.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a tool associated with APT41 and similar to Amaranth Loader (suggesting shared tooling/resources).
Referenced as an APT41-associated tool similar to Amaranth Loader; specific functionality not described in the provided content.
Listed as a tool used by the BRONZE ATLAS threat profile.
Reflective DLL loader used to decrypt and load the second-stage MoonWalk payload from an encrypted DAT file. It uses DLL sideloading, sandbox detection, dynamic API resolution, obfuscated hashing, and memory allocation to execute payloads in memory while evading analysis.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.