GammaLoad - HTA Double-Layered VBS Execution

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•3

Identifies mshta.exe launching the downloaded GammaLoad payload with specific command arguments, indicative of T1218.005 (Signed Binary Proxy Execution: Mshta).