SplatDropper

Malware type

loader, dropper

Family

Malware family

Operating systems

windows

Profile updated

2026-07-07 15:31:49

Targeted industries: government-and-public-sector technology-and-telecommunications

Targeted regions: country_code:cn country_code:vn

Context

SplatDropper is a loader that utilizes native windows API to deliver its payload to the victim environment. SplatDropper has been delivered through RAR archives and used legitimate executable for DLL side-loading. SplatDropper is known to be leveraged by Mustang Panda and was first observed utilized in 2025.

Detection coverage

• 144 Sigma rules

Malware & tools used

• Native API (attack-pattern)
• DLL (attack-pattern)
• Dynamic API Resolution (attack-pattern)
• Encrypted/Encoded File (attack-pattern)
• Code Signing (attack-pattern)
• Deobfuscate/Decode Files or Information (attack-pattern)
• Clear Persistence (attack-pattern)
• Windows Service (attack-pattern)

Used by threat actors

• Mustang Panda (threat-actor)

Reports & references

• MITRE ATT&CK — S1232 (report)

External references

• mitre-attack — S1232
• misp-galaxy