Turla Kazuar v3 File Downloads
Detects file creation events for specific files downloaded by the Turla Kazuar v3 loader. The malware downloads a set of files into the %LOCALAPPDATA%\Programs\HP\Printer\Driver directory including hpbprndi.exe (a legitimate signed Hewlett-Packard printer driver installer used as a loader with SHA256: 34b7df7919dbbe031b5d802accb566ce6e91df4155b1858c3c81e4c003f1168c), hpbprndiLOC.dll (the actual Kazuar v3 loader DLL that implements COM-based.
Sigma
