UnregStealer - 7za.exe Silent Archive Extraction

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•6

Correlates PowerShell invoking the download of 7za.exe to extract the hidden payload out.7z. This rule specifically looks for instances where '7za.exe' is executed with 'out.7z' in its command line, and this execution is preceded by 'powershell.exe' with '7-zip.org' in its command line on the same device. This pattern is indicative of the UnregStealer malware's method of extracting its payload.