WebSocket Backdoor Uses Downloader to Support Espionage and Data Theft
Summary
Analysis of a downloader uploaded to VirusTotal from Iraq found it retrieves a WebSocket backdoor that persists via a Run key, profiles systems, enumerates drives, and supports file exfiltration. Iranian origin is speculative.
Key points
- The downloader, document.exe, was uploaded to VirusTotal from Iraq on September 29, 2026; the article cautions that the developer's possible Iranian origin is a low-confidence assessment.
- It resolves Windows APIs by walking export tables and downloading staged files from 153.75.247[.]94 into an AppData directory.
- The downloader runs nvcontainer.exe after attempting to remove its Mark of the Web, with fallback execution methods.
- The backdoor communicates over WebSockets with www[.]xionamiconm[.]com:8050/ws/ and persists through the current user's Windows Run key.
- Its commands support drive and directory enumeration, downloading files, and preparing files or directories for exfiltration; large files are streamed, while smaller ones are ZIP-compressed.
- The article provides SHA-256 hashes for the downloader and backdoor, plus the payload-hosting IP and C2 address.
Article Details
- Attack Vectors
- A downloader retrieves the next-stage payload files over HTTP from 153.75.247[.]94.
- The downloader saves the files under AppData\Roaming\Microsoft\Protect\NV and executes nvcontainer.exe, with fallback execution methods.
- The backdoor establishes persistence through the current user's Windows Run registry key.
- The backdoor communicates with its C2 over WebSockets and supports drive and directory reconnaissance, file downloads, and file exfiltration.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | www[.]xionamiconm[.]com | Backdoor C2 hostname; the article specifies port 8050 and path /ws/. |
| IPV4 | 153[.]75[.]247[.]94 | Payload-hosting infrastructure used by the downloader. |
| SHA256 | 7bdd7d62f28d859e8dc63a962e56b4fbf72135fde0e92bebf36e2a4fde628f27 | SHA-256 hash identified for the nvcontainer.exe backdoor. |
| SHA256 | b6c49943afd87215dbd560583fc0c464f3dcf819278557953a33a811b4880f36 | SHA-256 hash identified for the document.exe downloader. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe backdoor uploads files to its C2, including streamed large files and compressed smaller files or directories.T1082 · System Information DiscoveryOn connection, the implant sends system profile information including the computer name and OS version.T1083 · File and Directory DiscoveryThe backdoor enumerates logical drives and lists directory contents.T1105 · Ingress Tool TransferThe downloader retrieves next-stage files from the payload host.T1140 · Deobfuscate/Decode Files or InformationThe downloader XOR-decrypts embedded strings using key 0x5A to reveal payload filenames and infrastructure.T1547.001 · Registry Run Keys / Startup FolderThe backdoor persists by setting a value under the current user's Windows Run registry key.
Products
Countries
Iranwith a possible target in Iraq, based on the submission geolocation. There are recent reports indicating Iran-nexus threat activity targeting the Kurdistan region of Iraq. However, additional indicators are neededIraqOn September 29 2026, @MalwareHunterTeam shared a suspicious low detection file named document.exe, uploaded to VirusTotal from Iraq on that same day. The sample has minimal detection in VirusTotal: