Loading malware…
MemLoader Edge is a malicious loader used by the APT group Mysterious Elephant in campaigns targeting government and foreign affairs entities in the Asia-Pacific region, especially South Asia, including Pakistan, Bangladesh, Afghanistan, Nepal, and Sri Lanka. In activity reported from early 2025, the group used spear-phishing emails, exploit kits, and malicious documents for initial access, then relied on PowerShell-based staging and persistence to deploy tooling including MemLoader Edge. The malware embeds an encrypted backdoor payload referred to as VRat, a variant derived from the open-source RAT vxRat, and decrypts and reflectively loads the embedded PE in memory. Its decryption routine iterates through a 1016-byte array to identify XOR keys until the decrypted content matches the MZ\x90 PE header. MemLoader Edge also includes evasion behavior: it tests connectivity to bing.com on TCP port 445 and changes behavior if the connection succeeds. The loaded VRat backdoor is identified in reporting by a PDB path string. Within the broader Mysterious Elephant intrusion set, MemLoader Edge supported operations focused on data theft, including exfiltration of sensitive files and WhatsApp-related data.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
MemLoader Edge is a loader that embeds and executes VRat, a variant of the open-source RAT vxRat.
Loader that performs sandbox/emulation checks (bing.com:445 connectivity test), brute-finds XOR keys to decrypt an embedded PE (expects 'MZ\x90'), then reflectively loads the decrypted RAT payload (VRat/vxRat-derived).
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.