Rule Info
Name
MAL_Websockets_Backdoor_Oct26
Author
MalGamy
Description
Detects WebSockets-based backdoor used for drive reconnaissance and data exfiltration, disguised as NVIDIA Container, likely related to Iranian threat activity targeting Iraq
Score
80
Date
2026-10-15
Minimum Yara
3.5.0
Rule Hash
57286f62a0f071b642cddbdb486568e4
Tags
['FILE', 'T1020', 'MAL', 'EXE']
Required Modules
[]
Virustotal Matches
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
1
Suspicious (< 10 engines)
0
Clean (0 engines)
0
Rule Matches
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR