Detect Sessiongate Downloader Pdb Path

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•1•0•6

This YARA rule detects a specific PDB (Program Database) path associated with the SessionGate 7ZipDownloader malware. The presence of this string in a file indicates that the file is likely a component of the SessionGate malware, specifically its 7ZipDownloader module. PDB paths are often left in compiled binaries and can serve as unique indicators for specific malware families or development environments.