No AI analysis yet.
According to HarfangLab, GammaLoad is a second-stage VBScript/HTA payload that serves as a persistent beacon and downloader for the next payload. It runs in a two-layer VBScript framework, with an outer installer enabling RunOnce-style persistence and the inner layer using MSXML2.XMLHTTP to beacon to its C2 over Cloudflare-proxied infrastructure. Attributed to: Gamaredon Group.