Threat reportMalwareTL-2026-4793
Obfuscated HTA Cobalt Strike Downloader Script (Double URL-encoded/Base64 layers, URLDownloadToFile, VBScript second stage)
An obfuscated .HTA script linked to Cobalt Strike acts as a multi-stage downloader, using URLDownloadToFile to fetch a VBScript second stage from 198.46.178.144. Obfuscation combines double URL encoding, excessive whitespace padding and Base64, and was decoded with CyberChef. First disclosed .
Key facts for Cobalt Strike HTA downloader
| Identifiers | TL-2026-4793 |
|---|---|
| Severity | MEDIUM |
| First disclosed | |
| Exploitation status | No known exploitation |
| Affected products | Microsoft Windows (HTA/mshta and Windows Script Host) |
| Malware | Cobalt Strike, Obfuscated HTA VBScript multi-stage downloader |
| Tools | CyberChef |
| MITRE ATT&CK techniques | T1027 Obfuscated Files or Information, T1027.010 Command Obfuscation, T1059.005 Visual Basic, T1071.001 Web Protocols, T1140 Deobfuscate/Decode Files or Information, T1204.002 Malicious File, T1218.005 Mshta |
| Motivation | UNKNOWN |
| Detection rules | 9 (1 shown free) |
| Sources | 6 cited sources |
Detection coverage for Cobalt Strike HTA downloader
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4793 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: HTA Stage - Mshta Launching HTA File or Remote URL (Cobalt Strike Downloader)
Behaviour-first detection of mshta.exe launching an .hta file or a remote URL, the execution step of the obfuscated HTA downloader tied to Cobalt Strike (TL-2026-4793). Also flags the research IOCs 198.46.178.144 and morningfiledatinglover.vbs and prioritises mshta started by Office, browsers, Explorer or other script hosts.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1218.005, T1204.002
- Data sources: sysmon, windows_process_creation
- Severity: high
- Confidence: high
Splunk SPL
```TL-2026-4793 HTA stage: mshta.exe launching an .hta file or a remote URL```
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\mshta.exe" OR OriginalFileName="MSHTA.EXE")
| eval cmd=lower(CommandLine), parent=lower(ParentImage)
| where like(cmd,"%.hta%") OR like(cmd,"%http://%") OR like(cmd,"%https://%") OR like(cmd,"%198.46.178.144%") OR like(cmd,"%morningfiledatinglover%")
```Parents that normally never start mshta raise the priority```
| eval risky_parent=if(match(parent,"(winword|excel|powerpnt|outlook|msedge|chrome|firefox|explorer|wscript|cscript|cmd|powershell)\\.exe$"),1,0)
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images by host, User, risky_parent
| convert ctime(first_seen) ctime(last_seen)
| sort - risky_parent - countMicrosoft KQL
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "mshta.exe" or ProcessVersionInfoOriginalFileName =~ "MSHTA.EXE"
| where ProcessCommandLine has_any (".hta", "http://", "https://", "198.46.178.144", "morningfiledatinglover")
| extend RiskyParent = InitiatingProcessFileName in~ ("winword.exe","excel.exe","powerpnt.exe","outlook.exe","msedge.exe","chrome.exe","firefox.exe","explorer.exe","wscript.exe","cscript.exe","cmd.exe","powershell.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, RiskyParent, SHA256
| order by RiskyParent desc, Timestamp descSigma
title: Mshta Launching HTA File or Remote URL - Cobalt Strike HTA Downloader
id: 6f1c2a4e-3b7d-4e58-9a21-7c0d5e8b1f01
status: experimental
description: Detects mshta.exe executing an .hta file or a URL, the entry point of the obfuscated HTA Cobalt Strike downloader (TL-2026-4793) that fetches morningfiledatinglover.vbs from 198.46.178.144.
references:
- https://www.embeeresearch.io/decoding-a-cobalt-strike-downloader-script-with-cyberchef/
- https://attack.mitre.org/techniques/T1218/005/
- https://attack.mitre.org/software/S0154/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/10/30
tags:
- attack.execution
- attack.t1204.002
- attack.defense-evasion
- attack.t1218.005
- attack.s0154
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: '\mshta.exe'
- OriginalFileName: 'MSHTA.EXE'
selection_cli:
CommandLine|contains:
- '.hta'
- 'http://'
- 'https://'
- '198.46.178.144'
- 'morningfiledatinglover'
condition: all of selection_*
falsepositives:
- Legitimate line-of-business HTA applications launched by IT
- Software installers that use HTA front-ends
level: high
Known false positives:
- Legitimate in-house HTA applications started by IT or installers
- Admin scripts that call mshta.exe with a URL for vendor tooling
Tuning notes: Allowlist signed internal HTA paths and known installer parents; keep the risky_parent weighting for alert priority. Index and sourcetype names assume Sysmon data in index=sysmon; adjust to your environment.
- Exploitation - Mshta Executing Remote HTA From Bare IP URL · unlock with TL Creds
- Post-Exploitation - VBScript Second Stage Dropped by Script Host ([indicator]) · unlock with TL Creds
- C2/Ingress - HTTP Download of VBScript From Bare IP ([indicator]/[indicator]) · unlock with TL Creds
- Exploitation - User-Executed HTA/[indicator] From Download or Temp Location · unlock with TL Creds
- Post-Exploitation - Mshta Spawning Script Host or Command Interpreter · unlock with TL Creds
- C2/Ingress - Connections to HTA Downloader Staging IP and Community-Related Infrastructure · unlock with TL Creds
- Post-Execution - Obfuscated Downloader Indicators (URLDownloadToFile, Mixed-Case FromBase64String, Double URL Encoding) · unlock with TL Creds
- C2/Ingress - Script Host Network Connection to Staging IP [indicator] or Bare Public IP · unlock with TL Creds
Indicators of compromise for Cobalt Strike HTA downloader
As of 2026-10-30, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-4793.
Sample indicators (2 of 10)
- IP address:
198.46.178[.]144 - File hash:
2807199adde4730e5e89c5f0ed3d48380dac746a44fa1e5fe0ca0186743a97e0
Defanged, TLP:CLEAR. Full set of 10 indicators: unlock with TL Creds.
How Cobalt Strike HTA downloader works
Embee Research (2024-08-04) analyzed an HTML Application (.HTA) sample obtained from MalwareBazaar (SHA-256 2807199adde4730e5e89c5f0ed3d48380dac746a44fa1e5fe0ca0186743a97e0) that is associated with Cobalt Strike and functions as a multi-stage downloader. The script is wrapped in three sequential obfuscation layers: double URL encoding (two rounds of URL decoding required), excessive whitespace padding inserted throughout the code, and a Base64-encoded payload.
After the layers are removed (CyberChef 'URL Decode' and 'From Base64' operations; whitespace collapsed with the regular expression \s\s+ in a text editor), the result is a VBScript-style downloader that calls the Windows URLDownloadToFile API to retrieve the next stage from http://198.46.178.144/morningfiledatinglover.vbs. The decoded code also hides the function name frombase64string by writing it in alternating upper and lower case characters, an additional string-matching evasion.
The source does not state initial delivery vector, victim targeting, the contents of the retrieved second stage, the Cobalt Strike configuration, or any attribution. Defenders should treat the HTA as a staging component: detect HTA/mshta execution, script-host network egress to bare IP addresses, URLDownloadToFile-style downloads of .vbs content, and the obfuscation patterns described. BeaconBeagle lookups for 198.46.178.144 returned no beacon or config records at the time of research (404 on the beacon endpoint; empty result set on config search).
MITRE ATT&CK techniques by tactic:
Defense Evasion
T1027 Obfuscated Files or Information; T1027.010 Command Obfuscation; T1140 Deobfuscate/Decode Files or Information; T1218.005 Mshta
Execution
T1059.005 Visual Basic; T1204.002 Malicious File
Command and Control
Remediation for Cobalt Strike HTA downloader
Immediate actions
- Block outbound connections to 198.46.178.144 and the URL http://198.46.178.144/morningfiledatinglover.vbs at proxy/firewall
- Hunt for the SHA-256 2807199adde4730e5e89c5f0ed3d48380dac746a44fa1e5fe0ca0186743a97e0 and the filename morningfiledatinglover.vbs on endpoints
- Search proxy and DNS/netflow logs for HTTP requests to bare IP hosts that fetch .vbs files from script hosts (mshta.exe, wscript.exe, cscript.exe)
Workarounds
- Block or disassociate the .hta file extension from mshta.exe for standard users
- Apply AppLocker/WDAC rules to restrict mshta.exe, wscript.exe and cscript.exe
Longer-term hardening
- Deploy EDR/behavioral detection for HTA execution and script-host child processes making network connections
- Alert on script content containing URLDownloadToFile combined with Base64 decoding and heavy URL-encoded or whitespace-padded content
- Restrict or remove mshta.exe and legacy script hosts where not business-required
Affected and fixed versions
- Microsoft — Windows (HTA/mshta and Windows Script Host)
Vulnerable versions: Systems permitting .hta and VBScript execution
Timeline of Cobalt Strike HTA downloader
- Article highlights the mixed-case frombase64string string, the \s\s+ whitespace padding and the URLDownloadToFile call as indicators usable for detection; deobfuscation performed in locked-ioc-8 with a text editor (VSCode).
- Decoded VBScript downloader reveals URLDownloadToFile retrieval of locked-ioc-2 and mixed-case obfuscation of the frombase64string function name.
- Excessive whitespace stripped with regex \s\s+ and the Base64 layer decoded with locked-ioc-8 From Base64.
- First obfuscation layer removed: double URL encoding decoded with two sequential locked-ioc-8 URL Decode operations.
- Analysis identifies the sample (SHA-256 locked-ioc-1) as an obfuscated locked-ioc-9 file linked to locked-ioc-7 (analysis reported August 2024; sample first-seen date not stated in source).
- Embee Research publishes 'Decoding a locked-ioc-7 Downloader Script With locked-ioc-8' analyzing an HTA sample sourced from MalwareBazaar.
- Threadlinqs re-check of locked-ioc-6 against BeaconBeagle (beacon endpoint) returned HTTP 404; no C2 beacon correlation found. MalwareBazaar page for the sample was not retrievable (bot verification), so first-seen date remains unknown.
Sources cited for Cobalt Strike HTA downloader
- MalwareBazaar sample 2807199adde4730e5e89c5f0ed3d48380dac746a44fa1e5fe0ca0186743a97e0 bazaar.abuse.ch · Research
- MITRE ATT&CK S0154 - Cobalt Strike MITRE · Research
- MITRE ATT&CK T1218.005 - System Binary Proxy Execution: Mshta MITRE · Research
- MITRE ATT&CK T1059.005 - Command and Scripting Interpreter: Visual Basic MITRE · Research
- CyberChef (GCHQ) gchq.github.io · Code repository
- Decoding a Cobalt Strike Downloader Script With CyberChef embeeresearch.io · Blog · 2024-08-04
Previous and next in malware
Drafted by the Threadlinqs research pipeline from 6 sources; published ; last updated —.
