VIMC UNITY Trojan File Activity

Daniel Jeremiah@daniyyell

•updated Jan 31, 2026•0•24

Detects file activity associated with the VIMC UNITY trojan. The rule identifies two main behaviors: (1) a process running from common temporary or user data directories (Temp, AppData, ProgramData, Downloads) creating or writing to a file named 'logs.txt'; and (2) the creation of 'XClient.exe' or 'shost.exe' within Temp, AppData, or ProgramData directories. This rule can serve as a supporting indicator and should ideally be correlated with other VIMC UNITY detection rules for higher confidence.