Rule Info
Name
SUSP_OBFUSC_JS_NullReceiver_Aug26
Author
Marius Benthin
Description
Detects obfuscated JavaScript patterns seen being used by Lazarus Group (DPRK) in NullReceiver and PolinRider campaigns
Score
75
Date
2026-08-17
Minimum Yara
3.5.0
Rule Hash
4c33da0ca794978890376ba15bf0836c
Tags
['T1059_007', 'G0032', 'NK', 'OBFUS', 'SUSP', 'T1027']
Required Modules
[]
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
15
Suspicious (< 10 engines)
21
Clean (0 engines)
3
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR