DRAYN Malware websocket-sharp C2 and PowerShell UUID Fingerprinting

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

Detects host-level evidence of DRAYN malware activity by correlating outbound network connections using a specific websocket-sharp User-Agent to a known command-and-control (C2) IP address with the execution of PowerShell commands performing system UUID fingerprinting (Win32_ComputerSystem).