Four-Detection BAT Stager Opens Door to Czech Utilities via Bitbucket CDN

An 8-kilobyte DOS batch file that only four of 76 antivirus engines flag at submission time is the opening move in a campaign targeting Czech utilities infrastructure — and the low detection count is not an accident. The file, nott.bat, carries two YARA rule hits that expose its construction: SUSP_PS1_JAB_Pattern_Jun22_1, which detects UTF-16 and Base64-encoded PowerShell opening with a single-character variable, and Base64_Encoded_URL, which fires on embedded encoded URI strings.