Animateclipper Mshta 7z Script Execution

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•5•1•29

Detects script content that invokes 'mshta.exe' from the 'SysWOW64' directory to access a remote resource ending with '.7z' via HTTP or HTTPS. This pattern is associated with the Animateclipper malware, which uses MSHTA for initial access or execution of malicious scripts.