Cornflake Svchost32 Fakeupdate Dropper
Detects CornFlake RAT dropper binaries requiring the svchost32 persistence path, fake update progress window strings, decoy update-lure terms, and Go-binary compiler artifacts together to reduce false positives on unrelated Go binaries or benign installers
YARA
