Remote Access Trojan · Worm · Dropper
VioletWorm - game.exe
- Author
- Moise Medici
- Updated
- 07 Sept 2026 · Completed
- Difficulty
- Easy
- Platform
- Capabilities
- Tags
Indicators Of Compromise
Network
- 130.12.181.70:7000
Mutex
- QakjxWa1r8Oh6UTB
Files dropped by the command handler, all under %TEMP%:
| Path | Dropped by |
|---|---|
%TEMP%\WinTempClean32.bat | WDKillerNew, the operator supplied Defender tampering script |
%TEMP%\3d847c5c-4f5a-4918-9e07-a96cea49048d.exe | JMar the ARP spoofing / MITM tool |
%TEMP%\89c43fcf-5e52-4be7-a719-a26139ce636a.exe | SnifStrt the packet sniffer |
%TEMP%\WinSc32.exe | HvNcX (administrator path) |
%TEMP%\7zip\7z.exe | 7zIT / 7zzip |
%TEMP%\<random GUID>.exe | SysKLL, NetDisCV, GrabberDC, CookieST, AntiiReset |
Registry, where <HWID> is the 20 uppercase hex characters returned by MakeIdFromOSInfo:
| Key | Value | Meaning |
|---|---|---|
HKCU\SOFTWARE\<HWID> | KL | keystrokes captured by the keylogger, read back by the KLGET command |
HKCU\SOFTWARE\<HWID> | NT | operator supplied label for the victim, written by SNote and echoed in every check-in |
Behavioural: the HvNcX command patches the first six bytes of AmsiScanBuffer in amsi.dll with C3 90 90 90 90 90, and explorer.exe is used as a launcher to break the parent/child process chain.