Rule Info
Name
MAL_HTA_ActiveX_Downloader_Persistence_Aug26
Author
Marius Benthin
Description
Detects malicious JavaScript in HTML application file which downloads and persists second-stage payload. Seen being used by UAC-0247
Score
80
Reference
Date
2026-08-10
Minimum Yara
3.5.0
Rule Hash
5cbf0210719c313b331a91c8194a288c
Tags
['MAL', 'FILE', 'T1053_005']
Required Modules
[]
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
14
Suspicious (< 10 engines)
3
Clean (0 engines)
5
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR