jodosjodos a1af57ff62 Detect EtherHiding PolinRider variant and generalize unknown-variant heuristic ...

Adds a third JS_VARIANTS entry for the dot-notation, decoder-array-free
payload that slipped past both known-signature matching and the old
generic heuristic (which required bracket notation, a decoder array,
and eval - all three, none of which this variant used). Also broadens
the generic heuristic to OR-based shape categories and adds a separate
technique-fingerprint detector for the EtherHiding blockchain C2
pattern, matched against unicode-decoded text so escaping individual
strings can't evade it.

2026-08-11 19:27:45 +02:00

..

_safety-probe.mjs

Add initial implementation of PolinRider malware scanner

2026-08-11 13:59:03 +02:00

ci.test.js

Add initial implementation of PolinRider malware scanner

2026-08-11 13:59:03 +02:00

exclude.test.js

Add initial implementation of PolinRider malware scanner

2026-08-11 13:59:03 +02:00

fonts.test.js

Add initial implementation of PolinRider malware scanner

2026-08-11 13:59:03 +02:00

helpers.js

Detect EtherHiding PolinRider variant and generalize unknown-variant heuristic

2026-08-11 19:27:45 +02:00

jsonc.test.js

Add initial implementation of PolinRider malware scanner

2026-08-11 13:59:03 +02:00

remediator.test.js

Add initial implementation of PolinRider malware scanner

2026-08-11 13:59:03 +02:00

report.test.js

Add initial implementation of PolinRider malware scanner

2026-08-11 13:59:03 +02:00

safe-exec.test.js

Add initial implementation of PolinRider malware scanner

2026-08-11 13:59:03 +02:00

safety.test.js

Add initial implementation of PolinRider malware scanner

2026-08-11 13:59:03 +02:00

scanner.test.js

Detect EtherHiding PolinRider variant and generalize unknown-variant heuristic

2026-08-11 19:27:45 +02:00

signatures.test.js

Detect EtherHiding PolinRider variant and generalize unknown-variant heuristic

2026-08-11 19:27:45 +02:00