Executive Summary
DRAYN is a highly malicious executable that functions as both a stealer and a loader, frequently masquerading as legitimate software like Visual Studio Code or Microsoft installers. The threat utilizes complex evasion techniques, including virtual machine detection and Geotargeting, specifically checking user locales to avoid infecting systems in CIS regions. Once active, it establishes persistent communication with Command & Control (C2) servers via WebSockets for real-time remote execution and further payload delivery.
Technically, the malware employs multiple persistence mechanisms including Windows Task Scheduler, Run, and RunOnce registry keys. It is notable for targeting Managed Service Provider (MSP) tools, specifically attempting to replace or corrupt the 'Advanced Monitoring Agent' to disable security monitoring and maintain high-privilege access. The use of self-extracting archives (SFX) with stealthy command-line arguments enables a 'silent' installation process that can survive system reboots and bypass basic user detection.