# Obfuscated HTA Cobalt Strike Downloader Script (Double URL-encoded/Base64 layers, URLDownloadToFile, VBScript second stage)

> An obfuscated .HTA script linked to Cobalt Strike acts as a multi-stage downloader, using URLDownloadToFile to fetch a VBScript second stage from 198.46.178.144. Obfuscation combines double URL encoding, excessive whitespace padding and Base64, and was decoded with CyberChef.

- **Published:** 2026-10-30T03:01:42Z
- **Last reviewed:** 2026-10-30T03:01:42Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4793
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4793.png
- **ID:** TL-2026-4793
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 10 (2 shown free below)

## Description

Embee Research (2024-08-04) analyzed an HTML Application (.HTA) sample obtained from MalwareBazaar (SHA-256 2807199adde4730e5e89c5f0ed3d48380dac746a44fa1e5fe0ca0186743a97e0) that is associated with Cobalt Strike and functions as a multi-stage downloader. The script is wrapped in three sequential obfuscation layers: double URL encoding (two rounds of URL decoding required), excessive whitespace padding inserted throughout the code, and a Base64-encoded payload.

After the layers are removed (CyberChef 'URL Decode' and 'From Base64' operations; whitespace collapsed with the regular expression \s\s+ in a text editor), the result is a VBScript-style downloader that calls the Windows URLDownloadToFile API to retrieve the next stage from http://198.46.178.144/morningfiledatinglover.vbs. The decoded code also hides the function name frombase64string by writing it in alternating upper and lower case characters, an additional string-matching evasion.

The source does not state initial delivery vector, victim targeting, the contents of the retrieved second stage, the Cobalt Strike configuration, or any attribution. Defenders should treat the HTA as a staging component: detect HTA/mshta execution, script-host network egress to bare IP addresses, URLDownloadToFile-style downloads of .vbs content, and the obfuscation patterns described. BeaconBeagle lookups for 198.46.178.144 returned no beacon or config records at the time of research (404 on the beacon endpoint; empty result set on config search).

## MITRE ATT&CK

- T1204.002 Malicious File
- T1059.005 Visual Basic
- T1218.005 Mshta
- T1027 Obfuscated Files or Information
- T1027.010 Command Obfuscation
- T1140 Deobfuscate/Decode Files or Information
- T1071.001 Web Protocols

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**HTA Stage - Mshta Launching HTA File or Remote URL (Cobalt Strike Downloader)** (`TL-2026-4793-SPL-001`)

Behaviour-first detection of mshta.exe launching an .hta file or a remote URL, the execution step of the obfuscated HTA downloader tied to Cobalt Strike (TL-2026-4793). Also flags the research IOCs 198.46.178.144 and morningfiledatinglover.vbs and prioritises mshta started by Office, browsers, Explorer or other script hosts.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1218.005, T1204.002
- **Data sources:** sysmon, windows_process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
```TL-2026-4793 HTA stage: mshta.exe launching an .hta file or a remote URL```
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\mshta.exe" OR OriginalFileName="MSHTA.EXE")
| eval cmd=lower(CommandLine), parent=lower(ParentImage)
| where like(cmd,"%.hta%") OR like(cmd,"%http://%") OR like(cmd,"%https://%") OR like(cmd,"%198.46.178.144%") OR like(cmd,"%morningfiledatinglover%")
```Parents that normally never start mshta raise the priority```
| eval risky_parent=if(match(parent,"(winword|excel|powerpnt|outlook|msedge|chrome|firefox|explorer|wscript|cscript|cmd|powershell)\\.exe$"),1,0)
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images by host, User, risky_parent
| convert ctime(first_seen) ctime(last_seen)
| sort - risky_parent - count
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "mshta.exe" or ProcessVersionInfoOriginalFileName =~ "MSHTA.EXE"
| where ProcessCommandLine has_any (".hta", "http://", "https://", "198.46.178.144", "morningfiledatinglover")
| extend RiskyParent = InitiatingProcessFileName in~ ("winword.exe","excel.exe","powerpnt.exe","outlook.exe","msedge.exe","chrome.exe","firefox.exe","explorer.exe","wscript.exe","cscript.exe","cmd.exe","powershell.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, RiskyParent, SHA256
| order by RiskyParent desc, Timestamp desc
```

### Sigma

```yaml
title: Mshta Launching HTA File or Remote URL - Cobalt Strike HTA Downloader
id: 6f1c2a4e-3b7d-4e58-9a21-7c0d5e8b1f01
status: experimental
description: Detects mshta.exe executing an .hta file or a URL, the entry point of the obfuscated HTA Cobalt Strike downloader (TL-2026-4793) that fetches morningfiledatinglover.vbs from 198.46.178.144.
references:
    - https://www.embeeresearch.io/decoding-a-cobalt-strike-downloader-script-with-cyberchef/
    - https://attack.mitre.org/techniques/T1218/005/
    - https://attack.mitre.org/software/S0154/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/10/30
tags:
    - attack.execution
    - attack.t1204.002
    - attack.defense-evasion
    - attack.t1218.005
    - attack.s0154
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\mshta.exe'
        - OriginalFileName: 'MSHTA.EXE'
    selection_cli:
        CommandLine|contains:
            - '.hta'
            - 'http://'
            - 'https://'
            - '198.46.178.144'
            - 'morningfiledatinglover'
    condition: all of selection_*
falsepositives:
    - Legitimate line-of-business HTA applications launched by IT
    - Software installers that use HTA front-ends
level: high

```

**Known false positives:**

- Legitimate in-house HTA applications started by IT or installers
- Admin scripts that call mshta.exe with a URL for vendor tooling

**Tuning notes:** Allowlist signed internal HTA paths and known installer parents; keep the risky_parent weighting for alert priority. Index and sourcetype names assume Sysmon data in index=sysmon; adjust to your environment.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Exploitation - Mshta Executing Remote HTA From Bare IP URL (locked: unlock with TL Creds)
- Post-Exploitation - VBScript Second Stage Dropped by Script Host ([indicator]) (locked: unlock with TL Creds)
- C2/Ingress - HTTP Download of VBScript From Bare IP ([indicator]/[indicator]) (locked: unlock with TL Creds)
- Exploitation - User-Executed HTA/[indicator] From Download or Temp Location (locked: unlock with TL Creds)
- Post-Exploitation - Mshta Spawning Script Host or Command Interpreter (locked: unlock with TL Creds)
- C2/Ingress - Connections to HTA Downloader Staging IP and Community-Related Infrastructure (locked: unlock with TL Creds)
- Post-Execution - Obfuscated Downloader Indicators (URLDownloadToFile, Mixed-Case FromBase64String, Double URL Encoding) (locked: unlock with TL Creds)
- C2/Ingress - Script Host Network Connection to Staging IP [indicator] or Bare Public IP (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 10)

Defanged, TLP:CLEAR.

- IP address: `198.46.178[.]144`
- File hash: `2807199adde4730e5e89c5f0ed3d48380dac746a44fa1e5fe0ca0186743a97e0`

Full set of 10 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Decoding a Cobalt Strike Downloader Script With CyberChef](https://www.embeeresearch.io/decoding-a-cobalt-strike-downloader-script-with-cyberchef/)
- [MalwareBazaar sample 2807199adde4730e5e89c5f0ed3d48380dac746a44fa1e5fe0ca0186743a97e0](https://bazaar.abuse.ch/sample/2807199adde4730e5e89c5f0ed3d48380dac746a44fa1e5fe0ca0186743a97e0/)
- [MITRE ATT&CK S0154 - Cobalt Strike](https://attack.mitre.org/software/S0154/)
- [MITRE ATT&CK T1218.005 - System Binary Proxy Execution: Mshta](https://attack.mitre.org/techniques/T1218/005/)
- [MITRE ATT&CK T1059.005 - Command and Scripting Interpreter: Visual Basic](https://attack.mitre.org/techniques/T1059/005/)
- [CyberChef (GCHQ)](https://gchq.github.io/CyberChef/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4793