TriBack Loader triad component file hashes
This rule identifies known malicious components associated with TriBack Loader by monitoring for exact cryptographic MD5 hash matches of three specific DLL files: hostfxr.dll, avk.dll, and MpClient.dll. By using exact hash matching, the rule minimizes the risk of false positives that might arise from filename-based detection of legitimate system binaries.
YARA
