Rule Info
Name
SUSP_VHDX_ZIP_Indicator_Jun26
Author
Florian Roth
Description
Detects .vhdx marker in small ZIP archives, which is often used in malicious email attachments (as seen in Remcos RAT campaigns)
Score
60
Date
2026-06-23
Minimum Yara
3.5.0
Rule Hash
3a845a8b47585e3c20725930d6438327
Tags
['SUSP', 'FILE', 'T1569_002']
Required Modules
[]
Virustotal Matches
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
10
Suspicious (< 10 engines)
24
Clean (0 engines)
7
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR