#ParsedReport #CompletenessMedium
14-10-2026

A Loader With No Command Line

https://activesoc.blackhillsinfosec.com/blog/a-loader-with-no-command-line/

Report completeness: Medium

Threats:
Uac_bypass_technique
Motw_bypass_technique
Screenconnect_tool
Spear-phishing_technique

Victims:
Government

Geo:
United states

TTPs:

IOCs:
Url: 3
File: 17
Command: 3
Registry: 5
Path: 1
Domain: 1

Soft:
Microsoft Defender, Windows Installer, curl, Active Directory, Microsoft 365, Windows service, Cloudflare

Algorithms:
zip, base64, sha256, xor

Functions:
Remove-Item, Get-Content

Languages:
cpython, python, php, powershell