MalwareBazaar Database

This page shows some basic information the YARA rule MAL_Backdoor_RuntimeBroker_WebSocket_Nov26 including corresponding malware samples.

Database Entry

YARA Rule:MAL_Backdoor_RuntimeBroker_WebSocket_Nov26
Create hunting rule
Author:quiet-heron-sec
Description:Detects a backdoor that installs itself as RuntimeBroker.exe in ProgramData and uses a WebSocket C2
Firstseen:2026-11-12 20:15:44 UTC
Lastseen:never
Sightings:1

Malware Samples

The table below shows all malware samples that matching this particular YARA rule (max 1000).

Firstseen (UTC)SHA256 hashTagsSignatureReporter