Remote Access Trojan · Worm · Dropper

VioletWorm - game.exe

Author: Moise Medici
Updated: 07 Sept 2026 · Completed
Difficulty: Easy
Platform: Windows
Capabilities: Dropping Secondary Payloads Persistence Mechanisms Command and Control C2 Communication Command Execution via Powershell Cmd Bash Data-Exfiltration File Encryption Keylogging Screen Capture Webcam Access Clipboard Manipulation Credential Theft AMSI and ETW Bypass Sandbox and VM Evasion Reflective Code Loading USB Spreading Denial of Service
Tags: python C#

File Info

File Name

e450b7efc8b429b618d2d22a074a3dd55c07b451eef315e0e20be7d9054ef18c.exe

SHA-256

e450b7efc8b429b618d2d22a074a3dd55c07b451eef315e0e20be7d9054ef18c

Size

12.4 MB

Source

The zip file linked above contains:

These are, respectively:

check_modules.c: the source of the small C utility used to confirm that AmsiScanBuffer and EtwEventWrite are present on the system; it is compiled to check_modules.exe before being run
check_modules.py: the corrected Python version of the same lookup, using LoadLibraryW and a bytes-like string that resolves the address the sample fails to find
decompiled: a directory containing the Python files that have been analyzed
- loader: the decompiled loader.py file, in two versions:
  - loader_clean.py: simplified to make it easier to read
  - loader_original.py: exactly as decompiled
- payload_extractor.py: a script that dumps the payload into stage2.data
- stage2.data: the payload that script dumps, analyzed in the last section of this report
e450b7efc8b429b618d2d22a074a3dd55c07b451eef315e0e20be7d9054ef18c.exe: the sample as downloaded from Malware Bazaar
extractor.py: the source code of 1, used to extract the source code from the exe file
game.exe_edited: contains the C# code with all classes and methods renamed according to the analysis below
string_decryptor.py: the script used to decrypt the obfuscated string constants of the .NET stage
unpacked: the output of pyinstxtractor, holding loader.pyc and the rest of the bundled PyInstaller archive