HelloDoor Command Execution Wrapper Detection

Brandon Rodriguez@BMRodriguez

•updated May 21, 2026•3•0•124

Detects the specific command execution wrapper used by the Rust-based HelloDoor malware (part of the Kimsuky PebbleDash cluster). The malware sets the code page to 65001 (UTF-8), suppresses output to nul, and chains the execution of a payload using cmd.exe.