Rule Info
Name
APT_MAL_Famous_Chollima_Branchlure_BAT_Launcher_Sep26
Author
Maurice Fielenbach
Description
Detects Windows batch launcher that stages the next-stage script and runs it, seen being used by Famous Chollima APT
Score
80
Reference
Internal Research
Date
2026-09-22
Minimum Yara
3.5.0
Rule Hash
796dd03e6b59b910046a0b0a2cddcb5f
Tags
['SCRIPT', 'NK', 'MAL', 'APT']
Required Modules
[]
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
1
Suspicious (< 10 engines)
8
Clean (0 engines)
3
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR