Rule Info
Name
MAL_JS_B64_NullReceiver_Sep26
Author
Marius Benthin
Description
Detects execution of Base64 encoded JavaScript seen being used by DPRK threat actor in NullReceiver campaign
Score
80
Reference
Internal Research
Date
2026-09-03
Minimum Yara
3.5.0
Rule Hash
da0061daa8f735668c6c375741813848
Tags
['T1059_007', 'T1132_001', 'MAL']
Required Modules
[]
Virustotal Matches
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
1
Suspicious (< 10 engines)
19
Clean (0 engines)
1
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR