DracuLoader

Cyber Defense Institute stated that this shellcode PE loader was observed staging win.hemigate.

Family metadata imported from Malpedia (Fraunhofer FKIE).