DRAYN VSCode Masquerade with websocket-sharp C2 and RunOnce/Run Persistence
Detects the DRAYN malware which masquerades as a VSCode or Microsoft installer. The rule looks for a silent 7ZipSfx installation that drops a temporary file (agent.tmp), performs C2 communication over WebSockets to a specific IP address (34.244.31.76), and establishes persistence via a RunOnce registry key using a modified vcredist_x86.exe execution.
YARA-L
