How can I load a Level3 DLL trojan (e.g., HTTP Proxy x64 sharedlib) using rundll32?
First, generate the configured DLL (e.g., `PC_Level3_http_dll.configured`). Use `dumpbin /exports` to find the exported function name, which for this type is typically `rst32`. Then run: `rundll32 PC_Level3_http_dll.configured, rst32`. Ensure DanderSpritz's PeddleCheap listener is set to HTTP protocol. This method works for Level3 DLL trojans, but Level4 DLLs like `Standard TCP Generic` do not support `rundll32` loading because they are designed for stealthy background execution. For more details, see the [DLL loading section in the guide](/news/nsa-danderspiritz-testing-guide-trojan-generation-and-testing).
Related article:
NSA DanderSpiritz Testing Guide - Trojan Generation and Testing