File Zfyljjvfrv: Https- New6.gdflix.cfd

rule GDFlix_Loader_Packed { meta: description = "Detects UPX‑packed loader from new6.gdflix.cfd" author = "Security Researcher – 2026" reference = "SHA256: B2A3D6F9C7E5A1D4B0F1E2C9A7D5E8F4B6C9A2D3F1E0B7C8A3D5F2E7C9B1A6F" date = "2026-04-18" strings: $upx = "UPX0" ascii $url = "https://new6.gdflix.cfd" ascii $runkey = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii $tempdir = "%APPDATA%