Polymorphic JS RAT loader: ActiveX + hex-index + base64-reverse obfuscation
Detects polymorphic multi-stage JavaScript RAT/backdoor loaders that dynamically rename variables and function headers per sample to evade signature-based detection. Identifies the malware via structural indicators that persist across renamed samples: ActiveXObject COM instantiation for filesystem/shell/explorer access, hex-indexed dynamic function resolution, and base64 decode-then-reverse deobfuscation idioms.
YARA
