TonRAT/PureRAT Node.js Run Key Persistence in AppData or ProgramData
Detects persistence mechanisms used by TonRAT and PureRAT, such as the Photo ZIP hospitality campaign, where registry Run or RunOnce keys are modified to execute malicious node.exe, .js, or .cmd files residing in user-writable directories like AppData, ProgramData, or Temp.
YARA-L
