Croxloader
CroxLoader is a custom Cobalt Strike loader used by Earth Longzhi, a subgroup of APT41, in campaigns observed from 2021 to 2022. It was delivered primarily via spear-phishing, including links that redirected victims to Google Drive hosting a password-protected archive containing the loader. The phishing lures were themed around information about a person. Researchers also noted Earth Longzhi exploited publicly exposed applications in related operations to deploy downloaders, shellcode loaders, and additional tooling.
CroxLoader is described as a simple but custom loader that accesses an encrypted payload such as "MpClient.bin" and decrypts hidden content. Its decryption routine includes the pattern '(sub 0xA) XOR 0xCC', a code similarity also noted with GroupCC tooling. Reported capabilities include decryption of embedded payloads, process injection, and use of decoy documents. Within the broader Earth Longzhi intrusion set, CroxLoader was one of several customized loaders alongside BigpipeLoader, MultiPipeLoader, and OutLoader, all used to stage Cobalt Strike.
The malware was observed in campaigns targeting organizations in Taiwan and other Asia-Pacific countries. Victim sectors attributed to Earth Longzhi included government, healthcare, infrastructure, banking, defense, aviation, insurance, and urban development. Attribution of the activity to APT41/Earth Longzhi was based on victimology, shared Cobalt Strike metadata, code similarities, and overlapping TTPs. Researchers specifically noted that Symatic loader and CroxLoader shared the same '(sub 0xA) XOR 0xCC' decryption algorithm pattern with GroupCC. No standalone network indicators for CroxLoader were provided in the source content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Upon opening the link, the victim is redirected to a Google Drive hosting a password-protected archive with a Cobalt Strike loader we call CroxLoader.
...the newly introduced Croxloader variant accesses the encrypted payload "MpClient.bin," and proceeds to decrypt its hidden content
Techniques & procedures
5 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniquesIn some cases, we also found that the group exploited publicly available applications to deploy and execute a simple downloader to download a shellcode loader and the necessary hack tools for the routine.
Both campaigns used spear-phishing emails as the primary entry vector to deliver Earth Longhzhi’s malware. The attacker embeds the malware in a password-protected archive or shares a link to download a malware, luring the victim with information about a person.
Upon opening the link, the victim is redirected to a Google Drive hosting a password-protected archive with a Cobalt Strike loader we call CroxLoader.
Privilege Escalation
1 techniqueStealth
1 techniqueCommand and Control
1 techniqueOutLoader tries to download the payload from a remote server ... exploited publicly available applications to deploy and execute a simple downloader to download a shellcode loader and the necessary hack tools
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Loader variant used by Earth Longzhi to access and decrypt an encrypted payload disguised as MPClient.dll/MpClient.bin.
Custom Cobalt Strike loader used in the second campaign. Variants were delivered via spear-phishing or exploitation of exposed applications, decrypting embedded payloads and injecting them into remote processes; some variants also used RtlDecompressBuffer and decoy documents.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.