Skip to content

Malware

BUGHATCH

According to Elastic, BUGHATCH is an in-memory implant loaded by an obfuscated PowerShell script that decodes and executes an embedded shellcode blob in its allocated memory space using common Windows

BUGHATCH is a Windows malware family.

Background

Elastic describes BUGHATCH as an in-memory implant that is loaded through an obfuscated PowerShell script. The script decodes an embedded shellcode blob and runs it within allocated memory using standard Windows APIs such as VirtualAlloc, CreateThread, and WaitForSingleObject.


Source: Malpedia (Fraunhofer FKIE).