DDKONG

Description

(Palo Alto) The malware in question is configured with the following three exported functions: • ServiceMain • Rundll32Call • DllEntryPoint

The ServiceMain exported function indicates that this DLL is expected to be loaded as a service. If this function is successfully loaded, it will ultimately spawn a new instance of itself with the Rundll32Call export via a call to rundll32.exe. The Rundll32Call exported function begins by creating a named event named ‘RunOnce’. This event ensures that only a single instance of DDKong is executed at a given time. If this is the only instance of DDKong running at the time, the malware continues. If it’s not, it dies. This ensures that only a single instance of DDKong is executed at a given time.

Names

Name
DDKONG

Category

Malware

Type

  • Backdoor

Information

Mitre Attack

Malpedia

Alienvault Otx

Other Information

Uuid

84cd6758-4303-4a23-a102-3853651997fa

Last Card Change

2020-04-23