Loader
DracuLoader
Cyber Defense Institute stated that this shellcode PE loader was observed staging win.hemigate.
DracuLoader is a Windows loader operated by Earth Estries.
Background
According to the Cyber Defense Institute, this shellcode-based PE loader was seen deploying win.hemigate.
Source: Malpedia (Fraunhofer FKIE).