TAXHAUL
Description
(Mandiant) TAXHAUL is a DLL that, when executed, decrypts a shellcode payload expected at C:\Windows\System32\config\TxR<machine hardware profile GUID>.TxR.0.regtrans-ms. Mandiant has seen TAXHAUL persist via DLL search order hijacking.
Names
| Name |
|---|
| TAXHAUL |
Category
Malware
Type
- Dropper
Information
Other Information
Uuid
71b734a7-1ca4-457f-97bd-d6112e85c41f
Last Card Change
2023-04-26