SUSP_OBFUSC_JS_NullReceiver_Aug26

Rule Info

Name
SUSP_OBFUSC_JS_NullReceiver_Aug26
Author
Marius Benthin
Description
Detects obfuscated JavaScript patterns seen being used by Lazarus Group (DPRK) in NullReceiver and PolinRider campaigns
Score
75
Date
2026-08-17
Minimum Yara
3.5.0
Rule Hash
4c33da0ca794978890376ba15bf0836c
Tags
['NK', 'T1027', 'OBFUS', 'SUSP', 'T1059_007', 'G0032']
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
23
Suspicious (< 10 engines)
30
Clean (0 engines)
5

Rule Matches

Timestamp
Positives
Total
Hash
VT
2026-10-04 20:45:27
1
62
27b2baee70948911234edf119a3e856bdfe133d3cca5669cd4933634eea0da9e
2026-10-04 13:40:25
11
63
b242b7607a933a7aa49a58275116dbd42615ef4e25173916fe8548766976217f
2026-10-01 20:02:27
1
62
42fb06aaeff5a891f2a019201940958a813fcc32ff9d8cebe895ebe43c9d1f34
2026-10-01 15:55:47
0
61
867a3669642b721c14d2d56f7f34e327f0be213ca73d2c969106da671575c49f
2026-09-29 22:59:38
11
62
3b572a613f5013a64e1877dfed3873f2bcbd52e5259b199d41e02c33840abbcb
2026-09-29 21:02:47
11
62
71c8f13a01c1bd48ac657931589495d0ca2332286d58a5d2f711c81343480d43
2026-09-28 14:55:05
9
62
08fc89f49a52f25b07426e9d4ca4024a5f8a3618ac88e91fc8e86938c6e32324
2026-09-26 06:18:56
1
60
57f0131d7a3e94fcb7b7009b392616a7290284dc9b56f4c9f5c3fe59b8088532
2026-09-25 20:14:26
11
63
5f49ac5c3b6960852f3dab12662172cf3a42b4c5afdfb62091622cf8b4c28489
2026-09-25 01:18:07
0
60
39fcaec3f6d5cff1da0cc54c1ce9e7202830b7f98173a01dadd6f8128a28adf1
2026-09-21 20:42:37
9
63
336fe7d9e959904c17337cdd4d162d9f9746dbbeb092fbfe56ce32cc1a2805ab
2026-09-18 19:42:45
10
62
b4f96ccce4cbf7864f68bc1d6d63f07e0b1bf32102addfe8636b4961cc10c87a
2026-09-18 15:25:16
10
62
38c2406609b1560c38935184fb7dfadb6d6992b6f6b7d69d6cd56f2f3165cb4d
2026-09-18 05:44:32
9
62
93c3f5fc27373e4f816a22cb95aaadabdc264d45c73a8759c0f33095b68086ec
2026-09-17 05:29:35
11
63
c24c8cbb082636aa46ecabe392b8b3144aa832bfc53613f4c64a865d82eb80cc
2026-09-17 00:29:06
10
62
b1645d539553b5863577cf9a85b3bcc4a420b78ac83b7e4f05c4a573d3375453
2026-09-16 17:10:55
1
62
0ec68abd834c4a6096ae09184381e2369b82dc8fe07920c787ef036b60a6b174
2026-09-15 16:13:07
9
60
9e286f7a54f071e5a4e9f09de84abca872d8347cbb7059c966c7db54a7e4dcba
2026-09-15 11:32:55
9
63
76ecad23f68284784fa6f3b9dd5408d83796542eb3de5b9ca7d1af5441608bd9
2026-09-11 20:47:06
9
58
0a472a13fd265f26c71bbf526b80a5b530c186d166f0c4fb3cf52761466eccd2
2026-09-11 19:56:46
2
63
ccc321dbc00ccbd67305de61a336374227ea7024a34c4f2e7461e5d7c15e2ca2
2026-09-10 16:17:06
0
61
b0ec8a495fecca43b8836ed421d328b7bb650da4040a7361bba3e3addcc5bf01
2026-09-10 16:10:26
8
52
983a9d00909a5364140c94bfb37c12b847f7357424a0b9e30ec96f2b2a44bfe6
2026-09-10 08:41:25
9
60
2c5cebff0f9e235afb48a63d631d6ef8b834458e74c8594ebb9b2b8b0c9c0413
2026-09-10 08:10:25
9
61
800b4a091d2259e76f144d28bc008efe9d53ef7a4c41557e25c8237c01e32509
2026-09-09 15:22:05
0
61
64e3b11b275ac6584fa6bd8c39bc275b6f899201ca703724d5eb87091046e4b3
2026-09-07 17:11:00
9
62
c2aaf6e0065fb8b9dfaf7eae5469a226213830319ded88820c1eca48e3c9b9fa
2026-09-07 05:45:26
17
62
9213dcf5a74eed1236e7ee233a27163986ca48198f34195646f051791cb4bd57
2026-09-05 01:29:16
0
62
9fc013efc2ddee0c27938ae57912b03df0a4c6c04b1b0453344d9ec287630e59
2026-09-03 10:15:01
1
57
b3f451001dea894f0e0f98425fd63641780aa03d49295f82b87ff8097c01fe3e
2026-09-03 09:57:36
8
60
02861de6cb7320956783d43aa68cdb9fee7c6b9dfe1f0cb0813792da9c1e631b
2026-09-01 22:51:36
9
62
a3818097b8a138f55aae300cca1c23a3495a5da18667bc7a03901a6d9344b6ed
2026-08-31 11:19:38
10
63
78268975bc02e202a0775424295263e38b15af41c4aa63304d809b37f51f1ddc
2026-08-30 15:39:15
13
61
833b0c014c082b6af866a65e4f6457f235d6cceab24d4e538c6f339278f89b1d
2026-08-29 10:51:25
9
62
f46711fd0cec3874dc8e1f0ba11afe1e1fffaa249db99c701a36dad1ae379a15
2026-08-28 19:30:26
9
62
b3e2dc8fef089b0495b6237dccef53ecabeb23f0fb362f6d77ea8d5a778195c5
2026-08-28 19:11:27
9
60
da2ed898d5335ec786592b183ce3cf2d61b8bc8bbf102ca8368cb6db44a567f3
2026-08-28 16:55:00
12
62
f42a7e64fd6b9dca938bc3df8ed68059fb48082f9d0438c9375844cc26874160
2026-08-27 03:59:06
9
60
d414e0737a498fe710e7ffb224de0ed14cf847bfc42b18529ca10d4e118882b9
2026-08-26 22:42:17
13
61
e7d740510f261fcc711cedd9686581812a4d271edfd485e44df4aeb121de8d86
2026-08-26 20:47:08
11
53
4993aa30d2d541be164763583a0b87f4a8c6f1d0c47a7c8a83b211600b3304e1
2026-08-26 13:43:38
18
61
6250fc1ab5eab3cb1347344739e4549d139a9a36cab098b98e5baed4cdbc217d
2026-08-26 04:41:38
2
62
606434078717162cc5ad23f4927cac6c25e0a481b9f8416cc266e2aa41f79756
2026-08-26 03:56:26
15
61
a08df674500b8167115b65dee2de5d1390725d90043648e626cd1828bfbcc8d1
2026-08-25 10:32:46
24
61
80a0da012a145acbcaf8c62b301bda9ea2fca452997cff630c2f555c760296a2
2026-08-25 09:12:26
10
62
99f039c67e31919919c15ddd48b9b22955f92d656cf8879ffc6e59c6e46a0532
2026-08-25 02:39:05
2
62
47353d2ce2724b3aa510bc5e304151d2f5af8b38aa188dd5664e10dc33aa3c1c
2026-08-25 02:35:17
3
61
e46268b5ea9bfa2f2e072934e1bf6a391b1bb11c5a2304c443f14a1f89747501
2026-08-25 02:32:55
23
60
f09a173317f32121a6ce2d96c8b767f6000f3be77fa34c738f03250b768ae6f9
2026-08-24 22:36:47
9
62
3b04fd40ddfc02b98f58c420da0b33025b2ce033b140df9f34a54703911338f2
2026-08-24 22:21:06
10
61
7a29d1deb0eaa8ada4e778028d27a054bec5e6389ecd7120b847646404a734bd
2026-08-24 09:32:37
9
59
46ceb060f4da73cd7361688541604b7f3291f75ab288d9d67bc919f4e5a6813e
2026-08-24 05:43:35
9
63
6f7dd43781e5ffe5fa50b572293569ab680d94c2809949a4fd9d9bdff21df2f2
2026-08-23 09:29:57
23
59
3287f2de563bd76465d353bd22b4d07c2af1cda9dd45efcb0da49e3ca49f7639
2026-08-22 05:29:06
10
60
b61b4cd5cd1d0cf3caf374e86b3db50a99fa7369a136854620ba372fb77baa43
2026-08-21 21:20:55
25
61
9fbb31129c04e8eb1a50519fc864c74d1b20d57c07d4099348f8fbc9a1a1eae6
2026-08-21 17:01:25
5
39
2b6ec2a0b8e75a796547a22b543c30a5bc369277356ac9334dc3e549f8720157
2026-08-21 15:13:41
2
59
f88b5b76adb6b4f05f076ff34df96cbaccba13429dec2925031f36adadd10401

Rule Matches per Month (last 24 months)