OXLOADER mpr.dll Load and WNetAddConnection2W Sandbox Probe
Detects the OXLOADER malware attempting to probe for sandbox or analysis environments by dynamically loading mpr.dll and invoking the WNetAddConnection2W API function. This activity is a known behavioral pattern used to identify system artifacts or network connectivity constraints indicative of security analysis environments.
YARA-L
