LokiBot Oct 2017 Malware Campaign - HTA File Transfer

This strike simulates download of a malicious .hta file in the 'LokiBot Oct 2017 Malware Campaign' via an HTTP request. The traffic occurs after executing the Word attachment from the phishing email. .hta file is often downloaded by pre-stage malware, such as embedded-macro word-files or distributed via 'LokiBot malware campaign phishing email'.