Also known as: DOILoader, GHOSTPULSE, IDAT Loader, SHADOWLADDER
No AI analysis yet.
According to Rapid7, this is a loader first spotted in July 2023. It implements several evasion techniques including Process Doppelgänging, DLL Search Order Hijacking, and Heaven's Gate. It has been observed to store its malicious payload in the IDAT chunk of PNG file format.