BabylonRAT Firefox-masquerading dropper (unsigned/mismatched PE)
Detects suspicious PE files that masquerade as Mozilla Firefox by using Firefox-related product names and metadata, but lack valid Mozilla Corporation code-signing signatures and are located within the ProgramData directory.
YARA
