MalwareBazaar Database

This page shows some basic information the YARA rule SUSP_PS1_JAB_Pattern_Jun22_1 including corresponding malware samples.

Database Entry

YARA Rule:SUSP_PS1_JAB_Pattern_Jun22_1
Create hunting rule
Author:Florian Roth
Description:Detects suspicious UTF16 and Base64 encoded PowerShell code that starts with a $ sign and a single char variable
Firstseen:2022-07-09 23:47:42 UTC
Lastseen:2025-12-11 18:55:54 UTC
Sightings:465

Malware Samples

The table below shows all malware samples that matching this particular YARA rule (max 1000).

Firstseen (UTC)SHA256 hashTagsSignatureReporter