← Reports Remote Access Trojan · Worm · Dropper VioletWorm - game.exe Author Moise Medici Updated 07 Sept 2026 · Completed Difficulty Easy Platform Windows Capabilities Dropping Secondary PayloadsPersistence MechanismsCommand and Control C2 CommunicationCommand Execution via Powershell Cmd BashData-ExfiltrationFile EncryptionKeyloggingScreen CaptureWebcam AccessClipboard ManipulationCredential TheftAMSI and ETW BypassSandbox and VM EvasionReflective Code LoadingUSB SpreadingDenial of Service Tags pythonC# Appendix 1 ↩ Github: PyInstaller Extractor 2 ↩ PyPi: uncompyle6 3 ↩ Github: depyo - Python bytecode decompiler in Node.js 4 ↩ Microsoft: Antimalware Scan Interface (AMSI) 5 ↩ Microsoft: AmsiScanBuffer function 6 ↩ Microsoft: VirtualProtect function 7 ↩ Microsoft: Memory Protection Constants 8 ↩ Linux Man Page: memmove(3) - Linux manual page 9 ↩ Medium: AMSI Bypass: In-memory patching 10 ↩ Windows: Event Tracing for Windows 11 ↩ Windows: EtwEventWrite function 12 ↩ Windows: Zone.Identifier Stream Name 13 ↩ Windows: SetFileAttribute function 14 ↩ Python Docs: subprocess - Subprocess management 15 ↩ Microsoft: Process Creation Flag 16 ↩ Microsoft: Manage connections from Windows 10 and Windows 11 operating system components to Microsoft services 16 ↩ Microsoft: System Error Codes (0-499) 17 ↩ Microsoft: Add-MpPreference 18 ↩ Microsoft: GetProcessWindowStation function 19 ↩ Microsoft: Window Stations 20 ↩ Microsoft: EnumDesktopsA function 21 ↩ Microsoft: GetDC function 22 ↩ Microsoft: BitBlt function 23 ↩ Microsoft: Device Contexts 24 ↩ Microsoft: OpenInputDesktop function 25 ↩ Microsoft: GetEncoding function 26 ↩ Microsoft: Socket.BeginReceive Method 27 ↩ Microsoft: Socket.Connect Method 28 ↩ Microsoft: WindowsPrincipal Class 29 ↩ Microsoft: capGetDriverDescriptionA function 30 ↩ Microsoft: ManagementObjectSearcher Class 31 ↩ Wikipedia: Advanced Encryption Standard 32 ↩ Microsoft: NewLateBinding.LateCall Method 33 ↩ Microsoft: Interaction.Shell(String, AppWinStyle, Boolean, Int32) Method 34 ↩ ConfuserEx Github: ConfuserEx Github Section 16 of 16: Appendix ← Indicators Of Compromise