Domino Loader

Domino Loader is a sophisticated malware with significant similarities to the Domino Backdoor. It operates as a loader, infiltrating systems through suspicious downloads, emails, or websites, often unbeknownst to the user. Once inside, it gathers basic system information and sends this data to a command and control center, whereupon it receives an encrypted payload. This payload is then decrypted using AES-256-CBC and a hardcoded key. The Domino Loader's unique feature is its export named ReflectiveLoader, which contains code taken from the ReflectiveDLLInjection project. This code enables DLL payloads to load directly from memory into a host process. In many instances, the received payload was found to be a second loader exhibiting code overlap with the Domino Backdoor, hence the name Domino Loader. The file placed on the target PC demonstrated sufficient similarity to the original Domino Backdoor to warrant its moniker. Upon activation, Domino Loader begins by loading an encrypted payload from its resources, decrypting it for use. The attack chain culminates when the Domino Loader installs either Cobalt Strike or the Project Nemesis infostealer on the compromised system. The final payload loaded by Domino Loader is a .NET assembly with MD5 hash D9FFB202D6B679E5AD7303C0334CD000, identified as the 'Project Nemesis' infostealer. This highlights the potential severity of a Domino Loader infection, as the malware can disrupt operations, steal personal information, or even hold data hostage for ransom.