Remote Access Trojan · Worm · Dropper

VioletWorm - game.exe

Author: Moise Medici
Updated: 07 Sept 2026 · Completed
Difficulty: Easy
Platform: Windows
Languages: Python C#
MITRE: T1047 (Windows Management Instrumentation) T1059.001 (Command and Scripting Interpreter: PowerShell) T1059.003 (Command and Scripting Interpreter: Windows Command Shell) T1059.006 (Command and Scripting Interpreter: Python) T1053.005 (Scheduled Task/Job: Scheduled Task) T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder) T1027.009 (Obfuscated Files or Information: Embedded Payloads) T1027.013 (Obfuscated Files or Information: Encrypted/Encoded File) T1036.005 (Masquerading: Match Legitimate Resource Name or Location) T1070.004 (Indicator Removal: File Deletion) T1070.006 (Indicator Removal: Timestomp) T1140 (Deobfuscate/Decode Files or Information) T1480.002 (Execution Guardrails: Mutual Exclusion) T1497.003 (Virtualization/Sandbox Evasion: Time Based Checks) T1564.001 (Hide Artifacts: Hidden Files and Directories) T1564.003 (Hide Artifacts: Hidden Window) T1620 (Reflective Code Loading) T1112 (Modify Registry) T1553.005 (Subvert Trust Controls: Mark-of-the-Web Bypass) T1685 (Disable or Modify Tools) T1033 (System Owner/User Discovery) T1057 (Process Discovery) T1082 (System Information Discovery) T1083 (File and Directory Discovery) T1120 (Peripheral Device Discovery) T1518.001 (Software Discovery: Security Software Discovery) T1005 (Data from Local System) T1113 (Screen Capture) T1095 (Non-Application Layer Protocol) T1105 (Ingress Tool Transfer) T1573.001 (Encrypted Channel: Symmetric Cryptography) T1041 (Exfiltration Over C2 Channel) T1048 (Exfiltration Over Alternative Protocol) T1499.002 (Endpoint Denial of Service: Service Exhaustion Flood)

Indicators Of Compromise

In the registry values below, <HWID> is the 20 uppercase hex characters returned by MakeIdFromOSInfo.

Network

130.12.181.70:7000

Mutex

QakjxWa1r8Oh6UTB

Files

%TEMP%\WinTempClean32.bat

dropped by WDKillerNew, the operator supplied Defender tampering script

%TEMP%\3d847c5c-4f5a-4918-9e07-a96cea49048d.exe

dropped by JMar, the ARP spoofing / MITM tool

%TEMP%\89c43fcf-5e52-4be7-a719-a26139ce636a.exe

dropped by SnifStrt, the packet sniffer

%TEMP%\WinSc32.exe

dropped by HvNcX (administrator path)

%TEMP%\7zip\7z.exe

dropped by 7zIT / 7zzip

%TEMP%\<random GUID>.exe

dropped by SysKLL, NetDisCV, GrabberDC, CookieST, AntiiReset

Registry

HKCU\SOFTWARE\<HWID>\KL

keystrokes captured by the keylogger, read back by the KLGET command

HKCU\SOFTWARE\<HWID>\NT

operator supplied label for the victim, written by SNote and echoed in every check-in

Behavioural. The HvNcX command patches the first six bytes of AmsiScanBuffer in amsi.dll with C3 90 90 90 90 90, and explorer.exe is used as a launcher to break the parent/child process chain.