GammaLoad Propose Change

Actor(s): Gamaredon Group

According to HarfangLab, GammaLoad is a second-stage VBScript/HTA payload that serves as a persistent beacon and downloader for the next payload. It runs in a two-layer VBScript framework, with an outer installer enabling RunOnce-style persistence and the inner layer using MSXML2.XMLHTTP to beacon to its C2 over Cloudflare-proxied infrastructure.

References

There is no Yara-Signature yet.