OXLOADER CIS Geofencing Check via GetUserGeoID and GetUserDefaultUILanguage
Detects the execution of known OXLOADER malware samples from temporary directories or download locations. The detection focuses on identifying specific filenames and file paths, while the rule metadata highlights the malware's behavior of performing geofencing checks (e.g., CIS region evasion) using Windows API functions to determine the system's locale.
YARA-L
