DiaoYu Loader Guardrail Check (pic1.png)

Yuri Mkrtumyan@nightfury

•updated Feb 8, 2026•9•0•95

This rule detects the creation of a zero-byte file named 'pic1.png' followed by the execution of any process from the same directory within a specified time window. This behavior is indicative of the DiaoYu Loader, which uses a zero-byte 'pic1.png' as a guardrail or check before executing its malicious payload.