Technical Analysis of Xloader Versions 6 and 7 P2

### Executive summary This technical analysis describes Xloader's multi-layered C2 decryption scheme, detailing how the malware constructs dynamic 20-byte keys, decrypts decoy and real C2 entries (using Base64, RC4 and subtraction algorithms), appends or extracts URL paths per version, and uses decoy domains to disguise real command-and-control communications — information that supports detection and reverse-engineering of the threat.