UAC-0226 WC3 Loader 60-Second Sleep Before Memory Allocation (Sandbox Evasion)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•3

Detects the execution of a malicious PowerShell loader associated with the UAC-0226 threat actor. The loader employs a 60-second sleep delay using the Start-Sleep cmdlet to evade automated sandbox analysis before proceeding to reflectively load the GIFTEDCROOK payload from a file located in C:\ProgramData\WC3.