DMLOADER
Description
(Trend Micro) More recently, we observed a new loader, DMLOADER, was implanted. Instead of loading an additional payload file, it loads the embedded payload and decodes it as an in-memory PE buffer. This loader usually has an export function called “DoMain” or “StartProtect.” In the decoded PE payload, it should have an export function called “MThread.”
Names
| Name |
|---|
| DMLOADER |
Category
Malware
Type
- Loader
Information
Other Information
Uuid
5b6875e1-8d92-44bf-89b5-57fd46577729
Last Card Change
2025-06-27