YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_SUSP_Reversed_Base64_Encoded_EXE

Detects an base64 encoded executable with reversed characters

Suspicious / huntingSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Florian Roth (Nextron Systems)
Date: 2020-04-06
Modified: 2026-05-15
Score / Quality: 80 / 85

What this rule detects

Detects an base64 encoded executable with reversed characters

It defines 8 patterns (8 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

susp-reversed-base64-encoded-exe.yarDetection Rule License 1.1

rule SIGNATURE_BASE_SUSP_Reversed_Base64_Encoded_EXE : FILE
{
	meta:
		description = "Detects an base64 encoded executable with reversed characters"
		author = "Florian Roth (Nextron Systems)"
		id = "3b52e59e-7c0a-560f-8123-1099c52e7e3d"
		date = "2020-04-06"
		modified = "2026-05-15"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_obfuscation.yar#L63-L84"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8"
		logic_hash = "0a2f1caf2235ee24f531c9f9a5ebdc0c97a90890218669749a4c83bede80a336"
		score = 80
		quality = 85
		tags = "FILE"

	strings:
		$s1 = "AEAAAAEQATpVT"
		$s2 = "AAAAAAAAAAoVT"
		$s3 = "AEAAAAEAAAqVT"
		$s4 = "AEAAAAIAAQpVT"
		$s5 = "AEAAAAMAAQqVT"
		$sh1 = "SZk9WbgM1TEBibpBib1JHIlJGI09mbuF2Yg0WYyd2byBHIzlGaU" ascii
		$sh2 = "LlR2btByUPREIulGIuVncgUmYgQ3bu5WYjBSbhJ3ZvJHcgMXaoR" ascii
		$sh3 = "uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV" ascii

	condition:
		filesize < 10000KB and 1 of them
}

Strings (8 patterns)

Identifier	Type	Value	Modifiers
$s1	text	"AEAAAAEQATpVT"
$s2	text	"AAAAAAAAAAoVT"
$s3	text	"AEAAAAEAAAqVT"
$s4	text	"AEAAAAIAAQpVT"
$s5	text	"AEAAAAMAAQqVT"
$sh1	text	"SZk9WbgM1TEBibpBib1JHIlJGI09mbuF2Yg0WYyd2byBHIzlGaU"	ascii
$sh2	text	"LlR2btByUPREIulGIuVncgUmYgQ3bu5WYjBSbhJ3ZvJHcgMXaoR"	ascii
$sh3	text	"uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV"	ascii

Condition

filesize < 10000KB and 1 of them

In plain words (Heuristic)

The file must be smaller than 10000KB (a cheap guard that skips large files).
At least 1 patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8

Licence & attribution

Author: Florian Roth (Nextron Systems)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 3b52e59e-7c0a-560f-8123-1099c52e7e3d

Tags:FILE

SIGNATURE_BASE_SUSP_MAL_EXFIL_Stealer_Output_Characteristics_Sep22_1
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-09-17
SIGNATURE_BASE_SUSP_OBFUSC_Powershell_True_Jun20_1
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2020-06-27
SIGNATURE_BASE_SUSP_PS1_JAB_Pattern_Jun22_1
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-06-10
SIGNATURE_BASE_SUSP_Base64_Encoded_Exploit_Indicators_Dec21
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-12-10
SIGNATURE_BASE_SUSP_Encoded_Discord_Attachment_Oct21_1
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-10-12
SIGNATURE_BASE_SUSP_IIS_Config_Proxyshell_Artifacts
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-08-25
SIGNATURE_BASE_SUSP_Jdniexploit_Error_Indicators_Dec21_1
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-12-10
SIGNATURE_BASE_SUSP_Jdniexploit_Indicators_Dec21
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-12-10