Home > List all groups > List all tools > List all groups using tool DMLOADER

Threat Group Cards: A Threat Actor Encyclopedia

Names	DMLOADER
Category	Malware
Type	Loader
Description	(Trend Micro) More recently, we observed a new loader, DMLOADER, was implanted. Instead of loading an additional payload file, it loads the embedded payload and decodes it as an in-memory PE buffer. This loader usually has an export function called “DoMain” or “StartProtect.” In the decoded PE payload, it should have an export function called “MThread.”
Information	<https://www.trendmicro.com/en_us/research/25/d/earth-kurma-apt-campaign.html>

Last change to this tool card: 27 June 2025

Download this tool card in JSON format

1 group listed (1 APT, 0 other, 0 unknown)

APT groups