Malware
DohDoor
According to Cisco Talos, Dohdoor is a 64-bit Windows DLL backdoor/loader, written in C/C++, that is delivered via DLL sideloading through legitimate Windows executables launched by batch and PowerShe
DohDoor is a Windows malware family.
Background
Cisco Talos characterizes Dohdoor as a 64-bit Windows DLL backdoor/loader coded in C/C++ that arrives through DLL sideloading from legitimate Windows executables kicked off by batch and PowerShell scripts. It resolves its C2 domains over DNS-over-HTTPS (DoH) using Cloudflare's DNS service, then opens an HTTPS tunnel to Cloudflare's edge to mask the hidden C2, so all traffic blends in with ordinary HTTPS to a reputable cloud provider. The malware fetches, decrypts (using a custom position-dependent XOR-SUB cipher accelerated with SIMD), and reflectively runs further payloads — likely Cobalt Strike — by process-hollowing into hardcoded Windows binaries such as OpenWith.exe and ImagingDevices.exe. For stealth it employs hash-based API resolution, encrypted C2, EDR evasion through ntdll syscall unhooking, and infrastructure and hostnames disguised as Windows updates and security tools.
Source: Malpedia (Fraunhofer FKIE).