Pay2Key 7za.exe Extracting data2.bin into Avast Directory for DLL Sideloading
Detects the use of 7za.exe, executed from temporary 7ZipSfx directories, to extract encrypted data (data2.bin) into the Avast Software directory. This activity is indicative of the Pay2Key ransomware attempting to perform DLL sideloading by dropping a malicious DLL, such as powrprof.dll, into a legitimate application folder to hijack execution flow.
YARA-L
