Havoc Loader Dll Sideloading With Adobe Arm Staging
This rule detects artifacts associated with the Havoc loader, specifically targeting a fake tech support scam. It looks for combinations of strings related to Adobe ARM staging, a 'license.key' file, and specific DLL names like 'vcruntime140_2.dll' and 'mpclient2.dll', which are indicative of the loader's operation and DLL sideloading techniques. The rule also includes a specific byte sequence ($a1) that may be a unique identifier for the Havoc loader.
YARA
