Edgecution Nativehost Xor Deobfuscation
This rule detects the presence of the Edgecution native_host.py Python backdoor by identifying specific, hardcoded code structures used for XOR deobfuscation. It specifically looks for the decryption loop combined with the registry lookup against 'HKCU\SOFTWARE\Microsoft\Edge' used to derive the decryption key, as well as distinct function names and error strings associated with the malware's implementation.
YARA
