# HTA-Based Cobalt Strike Downloader Script Analysis (CyberChef Deobfuscation)

> EmbeeResearch deobfuscated a Malware-Bazaar-sourced .HTA downloader that layers double URL-encoding, Base64, and whitespace padding to evade static analysis before invoking URLDownloadToFile to pull a hardcoded-IP-hosted second-stage VBS payload tied to Cobalt Strike toolkit distribution.

- **Published:** 2026-07-18T00:00:00Z
- **Last reviewed:** 2026-07-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1482
- **ID:** TL-2026-1482
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2024-08-04, EmbeeResearch published a step-by-step CyberChef deobfuscation walkthrough of an .HTA file sourced from Malware Bazaar (SHA-256 2807199adde4730e5e89c5f0ed3d48380dac746a44fa1e5fe0ca0186743a97e0). The .HTA opens with a small block of legitimate-looking HTML followed by a large batch of URL-encoded characters; two sequential CyberChef 'URL Decode' passes are required because the content was URL-encoded twice. Once decoded, the script is padded with long blobs of whitespace ('two or more' consecutive space characters) specifically to hinder manual and signature-based analysis; a regex substitution (\s\s+ -> single space), performed by the analyst in a text editor (VS Code), normalizes it. The cleaned script exposes a large Base64 blob passed to a mixed-case 'frombase64string' call — the randomized casing of the function name itself is a deliberate evasion choice intended to defeat case-sensitive string/YARA signatures; decoding this final layer (again requiring whitespace normalization) reveals the payload logic: a PowerShell routine invoking the Windows URLDownloadToFileA/W API to fetch a second-stage payload named morningfiledatinglover.vbs from the hardcoded IP-based URL http://198.46.178.144/morningfiledatinglover.vbs over plain HTTP (port 80, no TLS, no domain — a classic low-cost/disposable downloader-tier C2 hosting pattern). The overall chain — mshta.exe-triggered HTA execution, triple-nested encoding (URL x2 + Base64) for defense evasion, whitespace-padding to defeat static/manual analysis, and a VBS-fetching second-stage downloader — is associated by the researchers with Cobalt Strike toolkit distribution infrastructure, consistent with the well-documented pattern of commodity HTA/mshta loaders being used as an initial-access/staging layer ahead of a Cobalt Strike Beacon payload. No CVE, CVSS, KEV listing, or specific threat-actor attribution is given in the source; this is a downloader/dropper analysis rather than a vulnerability report, and the attributed link is to the Cobalt Strike toolkit/framework generally rather than to a named intrusion set. A BeaconBeagle infrastructure lookup for 198.46.178.144 returned no indexed correlation record at the time of this analysis (no active/cached beacon or config match), consistent with the IP being either short-lived, rotated, or not yet ingested by that source; this negative result is itself recorded as a research finding.

## MITRE ATT&CK

- T1059 Command and Scripting Interpreter
- T1218 System Binary Proxy Execution
- T1204 User Execution
- T1106 Native API
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1218 System Binary Proxy Execution
- T1620 Reflective Code Loading
- T1070 Indicator Removal
- T1497 Virtualization/Sandbox Evasion
- T1105 Ingress Tool Transfer
- T1071 Application Layer Protocol
- T1132 Data Encoding
- T1573 Encrypted Channel
- T1090 Proxy
- T1572 Protocol Tunneling
- T1003 OS Credential Dumping
- T1056 Input Capture
- T1548 Abuse Elevation Control Mechanism
- T1134 Access Token Manipulation
- T1021 Remote Services
- T1550 Use Alternate Authentication Material
- T1057 Process Discovery
- T1018 Remote System Discovery
- T1113 Screen Capture
- T1543 Create or Modify System Process

## Sources

- [Decoding a Cobalt Strike Downloader Script with CyberChef](https://www.embeeresearch.io/decoding-a-cobalt-strike-downloader-script-with-cyberchef/)
- [Decoding a Cobalt Strike Downloader Script With CyberChef (mirror)](https://infocon.org/mirrors/vx%20underground%20-%202025%20June/Papers/Malware%20Defense/Malware%20Analysis/2024/2024-08-04%20-%20Decoding%20a%20Cobalt%20Strike%20Downloader%20Script%20With%20CyberChef.pdf)
- [MalwareBazaar sample record (SHA-256 2807199adde4730e5e89c5f0ed3d48380dac746a44fa1e5fe0ca0186743a97e0)](https://bazaar.abuse.ch/sample/2807199adde4730e5e89c5f0ed3d48380dac746a44fa1e5fe0ca0186743a97e0/)
- [MalwareBazaar | Malware sample exchange](https://bazaar.abuse.ch/)
- [CyberChef (deobfuscation tool used in the analysis)](https://gchq.github.io/CyberChef/)
- [Detecting Popular Cobalt Strike Malleable C2 Profile Techniques](https://unit42.paloaltonetworks.com/cobalt-strike-malleable-c2/)
- [MITRE ATT&CK: Software S0154 - Cobalt Strike](https://attack.mitre.org/software/S0154/)
- [MITRE ATT&CK: T1218.005 - System Binary Proxy Execution: Mshta](https://attack.mitre.org/techniques/T1218/005/)
- [MITRE ATT&CK: T1027 - Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027/)
- [MITRE ATT&CK: T1105 - Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1482