Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
LoadToBadXml is a .NET Trojan loader that is obfuscated using Eziriz .NET Reactor.
5 distinct techniques documented for this family, organized by ATT&CK tactic.
Victim is redirected to compromised site which downloads a malicious HTML Application (.HTA)
This script uses PowerShell to download an additional script hosted on a compromised web server and executes the command using the PowerShell irm (Invoke-RestMethod) alias and iex (Invoke-Expression) alias commands.
The malware uses the CreateProcess Windows API to launch RegAsm.exe in a suspended state.
LoadToBadXml is a .NET Trojan loader that is obfuscated using Eziriz .NET Reactor.
The malware uses the CreateProcess Windows API to launch RegAsm.exe in a suspended state.
Atlantida abuses RegAsm.exe to proxy malicious code execution
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A .NET trojan loader used in the infection chain to decrypt XOR-encrypted payloads and inject them into RegAsm.exe using CreateProcess, VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread.
A .NET loader used in the Void Banshee infection chain. It decrypts XOR-encrypted payloads using the byte-array key (3, 2, 2), launches RegAsm.exe in a suspended state, allocates and writes payload memory, and starts a remote thread. Described as a modified version of the Donut project's shellcode injector, it injects the decrypted Donut loader, which subsequently executes Atlantida.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.