ThreatLabz

This technical analysis details APT41’s use of a signed-executable DLL sideloading chain: the DodgeBox reflective loader (sbiedll.dll) decrypts an AES-CFB-configured payload (sbiedll.dat) and loads the MoonWalk backdoor, which uses Google Drive for C2. The report examines DodgeBox’s features including salted FNV1a API resolution, DLL unhooking, Control Flow Guard bypassing, machine-targeted payload keying, DLL hollowing/reflective loading, execution guardrails (argument, MAC/computer name, privilege checks), and call-stack spoofing used to evade detection.