Renamed vsdbg.exe/vsdbg.dll NativeAOT loader with oversized .reloc (PUROSANGUE)
Detects the PUROSANGUE malware loader, which achieves execution by being sideloaded as 'vsdbg.dll' alongside a legitimate debugger executable. The detection leverages YARA rules focusing on specific artifacts such as a hardcoded build path, a custom Base16 alphabet, and a structural anomaly in the PE file's .reloc section compared to the declared base relocation directory size, alongside known malicious hash values.
YARA
