Day 53 Coyote Banking Trojan

This YARA rule detects a specific Base64 decoding routine and associated hardcoded string patterns used by the Coyote Banking Trojan. The rule scans for bytecode sequences corresponding to .NET methods such as System.Text.Encoding::get_UTF8 and System.Convert::FromBase64String, which the malware uses to deobfuscate its malicious payloads or configuration components.