Our research team identified a second downloader variant linked to the WebSockets backdoor campaign recently analyzed by @dmpdump. While the original downloader was written in native C++, this new variant uses C# (.NET 8). Same seven payload files, same NVIDIA-themed disguise, but a very different implementation: no obfuscation, plaintext strings, and extensive retry logic designed to handle hours of unreliable connectivity. An interesting detail: it ships as a 14 MB self-contained .NET single-file executable. Open it in IDA and you'll mainly see the native .NET runtime host rather than the actual downloader logic. We've developed three new YARA detection rules covering both downloader variants and the WebSockets backdoor, and added them to our THOR scanners. You can explore the rules' matches on VirusTotal through our Valhalla pages: valhalla.nextron-systems.com… valhalla.nextron-systems.com… valhalla.nextron-systems.com… Full technical analysis, decompiled source and IOCs: github.com/NextronSystems/io…