Pay2Key DLL Search Order Hijacking Targeting Avast Antivirus

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects Pay2Key ransomware attempting DLL search order hijacking against Avast Antivirus components. The rule monitors for two behaviors: Windows system DLLs (e.g., powrprof.dll) being loaded from the Avast installation directory, and Avast-specific component DLLs (e.g., snxhk.dll, ashBase.dll) being loaded from non-standard file paths outside the legitimate Avast software installation directory.