Executive Summary
SplatDropper is a Windows loader that uses native APIs to deliver payloads via RAR archives and DLL side‑loading through legitimate executables. First seen in 2025 and tied to Mustang Panda, it enables subsequent deployment of higher‑impact malware. This activity often surfaces as anomalous DLL injections or process hijacking and can bypass standard application whitelisting measures.
Enhanced Description
SplatDropper is a lightweight Windows loader that employs native API calls to deploy its malicious payload into the victim’s environment. It typically arrives bundled within RAR archives and leverages legitimate executables for DLL side‑loading, allowing it to piggyback on trusted binaries to bypass basic application whitelisting controls. First identified in 2025, SplatDropper has been linked to the Mustang Panda threat group, which often uses this loader as a stepping stone to install more advanced components such as backdoors or credential harvesters. Once executed, SplatDropper expands its payload from the compressed archive and performs side‑loading using DLL search order hijacking. By injecting malicious libraries through legitimate execution contexts it can conceal its presence even in environments that monitor for unsigned binaries. The loader’s design emphasizes stealth: it suppresses console outputs, uses process injection to hide spawned shells, and cleans up residual artifacts after installation, making endpoint detection extremely challenging without specialized monitoring of system call patterns. The impact of SplatDropper is proportional to the payload it delivers. In many observed attacks the loader has introduced high‑privilege RATs capable of network reconnaissance, credential theft, and persistence through registry or scheduled task creation. Because the loader itself is minimal yet versatile, security teams must treat any unexplained DLL loading activity as potential indicator of compromise.
Key Capabilities
ATT&CK Techniques
Recommended Actions
Suggested Tags
Confidence Assessment
The available data provides a clear view of SplatDropper’s basic delivery mechanism and association with Mustang Panda, giving moderate confidence in its functionality. However, missing details about the specific payloads delivered, persistence methods, command‑and‑control infrastructure, and full lifecycle limits a comprehensive assessment and highlights gaps that require further investigation.
SplatDropper is a loader that utilizes native windows API to deliver its payload to the victim environment. SplatDropper has been delivered through RAR archives and used legitimate executable for DLL side-loading. SplatDropper is known to be leveraged by Mustang Panda and was first observed utilized in 2025.