Skip to content

Malware

YoungLotus

aka DarkShare

Simple malware with proxy/RDP and download capabilities.

YoungLotus, also known as DarkShare, is a Windows malware family.

Background

A basic malware offering proxy/RDP and file-download functionality, frequently distributed packaged inside installers, especially within the Chinese sphere.

Its PE timestamps point to an origin in the latter half of 2014.

Certain builds query the internet connection state (InternetGetConnectedState: MODEM, LAN, PROXY), while others run rudimentary checks for antivirus processes (CreateToolhelp32Snapshot).


Source: Malpedia (Fraunhofer FKIE).