内容仅以原始语言提供
class="post-article">
Loader JScript/HTA 自2026年起活跃

QUOTEHTADropper

HTA dropper with double extension PDF lure (QUOTE-05348-2026.pdf.hta). WScript.Shell environment variable chunk payload delivery (30,000 char blocks). AES decryption key MqVI5ZYptsWhg4UT. Hidden no-taskbar single-instance HTA. PowerShell payload injection.

威胁档案
类型 Loader
编程语言JScript/HTA
C2协议HTTP/PowerShell
首次发现2026
目标 Küresel
用途 / 能力
  • HTA Dropper/PowerShell Injector
尚未发现该家族的 C2 服务器。

研究报告 (1)

Yüksek

QUOTEHTADropper 9fa0a886 -- QUOTE-05348-2026.pdf.hta Cift Uzanti PDF Lur, WScript.Shell Cevre Degiskeni Payload Parca Depolama MqVI5ZYptsWhg4UT AES Anahtari PowerShell Enjeksiyonu | Yuksek

QUOTEHTADropper 9fa0a886 HTML/HTA 403KB. QUOTE-05348-2026.pdf.hta cift uzanti PDF lur. WScript.Shell cevre degiskeni P1 P2 P3 payload chunking. MqVI5ZYptsWhg4UT AES anahtari. PowerShell enjeksiyonu.

阅读报告 →