Dropped Renamed-Binary Sideload: Evernote.zip + notepad++.exe ZIP
Detects the presence of ZIP archive files masquerading as 'Evernote.zip' that contain 'notepad++.exe', which is a pattern frequently observed in VBScript-based downloaders utilizing binary sideloading to execute malicious payloads.
YARA
