Fake Telegram/KeePass/Pictory Installer Masquerade (HEAVYGRAM)
This rule detects Windows executable files that attempt to masquerade as legitimate software installers for Telegram, KeePass, or Pictory. These filenames and branding artifacts are associated with social engineering campaigns known to distribute malware families such as HEAVYGRAM and CRUDEEXCLUDE.
YARA
