DDKONG
Description
(Palo Alto) The malware in question is configured with the following three exported functions: • ServiceMain • Rundll32Call • DllEntryPoint
The ServiceMain exported function indicates that this DLL is expected to be loaded as a service. If this function is successfully loaded, it will ultimately spawn a new instance of itself with the Rundll32Call export via a call to rundll32.exe. The Rundll32Call exported function begins by creating a named event named ‘RunOnce’. This event ensures that only a single instance of DDKong is executed at a given time. If this is the only instance of DDKong running at the time, the malware continues. If it’s not, it dies. This ensures that only a single instance of DDKong is executed at a given time.
Names
| Name |
|---|
| DDKONG |
Category
Malware
Type
- Backdoor
Information
Mitre Attack
Malpedia
Alienvault Otx
Other Information
Uuid
84cd6758-4303-4a23-a102-3853651997fa
Last Card Change
2020-04-23