TAMECAT
Description
(Mandiant) TAMECAT is a PowerShell toehold that can execute arbitrary PowerShell or C# content. TAMECAT has been observed dropped by malicious macro documents, communicates with its C2 node via HTTP, and expects data from the C2 to be Base64-encoded.
Names
| Name |
|---|
| TAMECAT |
Category
Malware
Type
- Backdoor
Information
Mitre Attack
Other Information
Uuid
7340d8f6-ce8c-4b0b-be88-f93b2f562eb6
Last Card Change
2025-06-28