It reads to me that the DLL is something they found later while trying to determine what the attacker was doing after they were already in.

Sure, but it's a mobile ad, how is a DLL going to do anything