← Reports

Remote Access Trojan · Worm · Dropper

VioletWorm - game.exe

Author
Moise Medici
Updated
07 Sept 2026 · Completed
Difficulty
Easy
Platform
Windows
Languages
PythonC#
MITRE
T1047 (Windows Management Instrumentation) T1059.001 (Command and Scripting Interpreter: PowerShell) T1059.003 (Command and Scripting Interpreter: Windows Command Shell) T1059.006 (Command and Scripting Interpreter: Python) T1053.005 (Scheduled Task/Job: Scheduled Task) T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder) T1027.009 (Obfuscated Files or Information: Embedded Payloads) T1027.013 (Obfuscated Files or Information: Encrypted/Encoded File) T1036.005 (Masquerading: Match Legitimate Resource Name or Location) T1070.004 (Indicator Removal: File Deletion) T1070.006 (Indicator Removal: Timestomp) T1140 (Deobfuscate/Decode Files or Information) T1480.002 (Execution Guardrails: Mutual Exclusion) T1497.003 (Virtualization/Sandbox Evasion: Time Based Checks) T1564.001 (Hide Artifacts: Hidden Files and Directories) T1564.003 (Hide Artifacts: Hidden Window) T1620 (Reflective Code Loading) T1112 (Modify Registry) T1553.005 (Subvert Trust Controls: Mark-of-the-Web Bypass) T1685 (Disable or Modify Tools) T1033 (System Owner/User Discovery) T1057 (Process Discovery) T1082 (System Information Discovery) T1083 (File and Directory Discovery) T1120 (Peripheral Device Discovery) T1518.001 (Software Discovery: Security Software Discovery) T1005 (Data from Local System) T1113 (Screen Capture) T1095 (Non-Application Layer Protocol) T1105 (Ingress Tool Transfer) T1573.001 (Encrypted Channel: Symmetric Cryptography) T1041 (Exfiltration Over C2 Channel) T1048 (Exfiltration Over Alternative Protocol) T1499.002 (Endpoint Denial of Service: Service Exhaustion Flood)

File Info

File Name
e450b7efc8b429b618d2d22a074a3dd55c07b451eef315e0e20be7d9054ef18c.exe
SHA-256
e450b7efc8b429b618d2d22a074a3dd55c07b451eef315e0e20be7d9054ef18c
Size
12.4 MB
Source
https://bazaar.abuse.ch/sample/e450b7efc8b429b618d2d22a074a3dd55c07b451eef315e0e20be7d9054ef18c
Download sample (.zip)

The zip file linked above contains:

  • check_modules.c
  • check_modules.py
  • decompiled
    • loader
      • loader_clean.py
      • loader_original.py
    • payload_extractor.py
    • stage2.data
  • e450b7efc8b429b618d2d22a074a3dd55c07b451eef315e0e20be7d9054ef18c.exe
  • extractor.py
  • game.exe_edited
  • string_decryptor.py
  • unpacked
    • base_library.zip
    • _bz2.pyd
    • … [removed for brevity]
    • _zstd.pyd

These are, respectively:

  • check_modules.c: the source of the small C utility used to confirm that AmsiScanBuffer and EtwEventWrite are present on the system; it is compiled to check_modules.exe before being run
  • check_modules.py: the corrected Python version of the same lookup, using LoadLibraryW and a bytes-like string that resolves the address the sample fails to find
  • decompiled: a directory containing the Python files that have been analyzed
    • loader: the decompiled loader.py file, in two versions:
      • loader_clean.py: simplified to make it easier to read
      • loader_original.py: exactly as decompiled
    • payload_extractor.py: a script that dumps the payload into stage2.data
    • stage2.data: the payload that script dumps, analyzed in the last section of this report
  • e450b7efc8b429b618d2d22a074a3dd55c07b451eef315e0e20be7d9054ef18c.exe: the sample as downloaded from Malware Bazaar
  • extractor.py: the source code of 1, used to extract the source code from the exe file
  • game.exe_edited: contains the C# code with all classes and methods renamed according to the analysis below
  • string_decryptor.py: the script used to decrypt the obfuscated string constants of the .NET stage
  • unpacked: the output of pyinstxtractor, holding loader.pyc and the rest of the bundled PyInstaller archive