SVG Phishing CHM Spawns Remote HTA
Detects the execution of the HTML Help executable (hh.exe) followed closely by the execution of mshta.exe loading a remote resource. This pattern is indicative of a malicious CHM file being used to launch a remote HTA file, a technique observed in a campaign delivering Amatera Stealer and PureMiner.
YARA-L
