Remote Access Trojan · Worm · Dropper
VioletWorm - game.exe
- Author
- Moise Medici
- Updated
- 07 Sept 2026 · Completed
- Difficulty
- Easy
- Platform
- Languages
- MITRE
MITRE ATT&CK
Execution
Windows Management Instrumentation
getAllInstalledAntivirus runs a WMI query through ManagementObjectSearcher, Select * from AntivirusProduct against root\SecurityCenter2, every time the RAT builds its INFO check-in.Command and Scripting Interpreter: PowerShell
The .NET dropper
mshost6x5y.exe spawns powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'", as captured by Procmon during the dynamic run.Command and Scripting Interpreter: Windows Command Shell
The RAT’s
R/ command starts a hidden CMD.EXE with redirected standard streams and runnnnnn types operator commands into it, while WDKillerNew drops and runs %TEMP%\WinTempClean32.bat.Command and Scripting Interpreter: Python
The first stage is
loader.py, a Python 3.14 script compiled to loader.pyc and bundled with PyInstaller, so all of the loader logic runs in the embedded python314.dll interpreter.Persistence
Scheduled Task/Job: Scheduled Task
The RAT runs
schtasks.exe /create /f /sc minute /mo 1 /tn "game" with /tr pointing at its copy in %APPDATA%\game.exe, so the task relaunches it every minute.Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
The loader writes the
WindowsDefender value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, the dropper adds its own Run value, and the RAT copies itself into the Startup folder and registers its %APPDATA% copy under Run.Stealth
Obfuscated Files or Information: Embedded Payloads
loader.py carries the entire .NET dropper as one embedded Base64 blob, and that dropper (stage2.data) carries game.exe in turn, writing it to %LOCALAPPDATA%\MicrosoftPQGHQ\game.exe.Obfuscated Files or Information: Encrypted/Encoded File
The loader’s payload is AES-CBC encrypted and gzip compressed, the dropper’s payload is XOR encrypted, and the RAT hides its strings, including the C2 address
130.12.181.70, behind double Base64 and the XOR key EPERGYn.Masquerading: Match Legitimate Resource Name or Location
The loader copies itself to
%LOCALAPPDATA%\Microsoft\Windows\RuntimeBroker.exe, names the dropped stage from system-like prefixes and suffixes (mshost6x5y.exe) under Microsoft\Windows\Caches, and calls its Run value WindowsDefender.Indicator Removal: File Deletion
After launching the dropped stage, the loader’s
delayed_cleanup thread resets its attributes and deletes it with os.remove, which is why mshost6x5y.exe is gone after the dynamic run.Indicator Removal: Timestomp
The loader copies the access and modification times of
C:\Windows\System32\kernel32.dll onto the dropped executable with os.utime, so the new file blends in with system binaries.Deobfuscate/Decode Files or Information
Each stage decodes the next at runtime (Base64, AES-CBC and gunzip in the loader; Base64,
Array.Reverse, XOR and GZipStream in the dropper), and the RAT decrypts its constants with stringDecryptor.Execution Guardrails: Mutual Exclusion
The RAT’s
Main creates the mutex QakjxWa1r8Oh6UTB through Helpers.CreateMutex and calls Environment.Exit(0) when it already exists, so only one instance runs per host.Virtualization/Sandbox Evasion: Time Based Checks
Before decrypting its payload, the loader times a one million iteration loop with
time.time() and exits when it finishes in under 0.01 seconds, treating that as a sandbox accelerating time.Hide Artifacts: Hidden Files and Directories
The loader marks the dropped stage hidden and system with
SetFileAttributesW(path, 6), and the RAT’s hidefolderfile command hides any operator-chosen path with FileSystem.SetAttr(path, FileAttribute.Hidden).Hide Artifacts: Hidden Window
The loader calls
FreeConsole and ShowWindow(hwnd, 0) and starts the next stage with SW_HIDE and CREATE_NO_WINDOW, while the dropper’s PowerShell and the RAT’s CMD.EXE also run without a window.Reflective Code Loading
The RAT receives Base64 .NET plugins from the C2, loads them in memory with
Assembly.Load in ReflectiveCodeLoading and calls them via NewLateBinding.LateCall; HvNcX invokes a loaded assembly’s entry point the same way.Defense Impairment
Modify Registry
The loader sets
EnableSmartScreen and EnableWebContentEvaluation to 0 through winreg, and the RAT’s regfuc command writes arbitrary REG_DWORD values with the WScript.Shell RegWrite method.Subvert Trust Controls: Mark-of-the-Web Bypass
The loader’s
bypass_smartscreen deletes the :Zone.Identifier alternate data stream of its own executable, stripping the Mark-of-the-Web so SmartScreen no longer treats it as a downloaded file.Disable or Modify Tools
The dropper adds a Defender exclusion with
Add-MpPreference -ExclusionPath 'C:\Users', the loader disables SmartScreen via HKLM\SOFTWARE\Policies\Microsoft\Windows\System\EnableSmartScreen, and HvNcX patches AmsiScanBuffer with C3 90 90 90 90 90.Discovery
System Owner/User Discovery
The
INFO check-in built by ScanOS reports Environment.UserName and whether the current user holds the Administrator role, checked with WindowsPrincipal.IsInRole in IsUserAdmin.Process Discovery
The
R# command walks Process.GetProcesses() and sends each process name, PID and MainModule.FileName back to the C2 as the panel’s remote task manager list.System Information Discovery
ScanOS collects the OS name, service pack and 32/64-bit flag, and MakeIdFromOSInfo hashes the processor count, machine name, OS version and system drive size into the victim ID.File and Directory Discovery
The
GetDrives and FileManager commands enumerate drives by type and list the folders and files, with sizes, of any path the operator requests through ListFolders and ListFiles.Peripheral Device Discovery
isCaptureDriverAvailable loops capGetDriverDescriptionA over driver indexes 0 to 4 to detect a webcam for the INFO check-in, and ListDrives tags removable, CD-ROM and network drives.Software Discovery: Security Software Discovery
getAllInstalledAntivirus collects the displayName of every installed AntivirusProduct and sends the comma-separated list, or None, to the C2 in each INFO check-in.Collection
Data from Local System
The
tss command reads a whole file with ReadAllText, and downloadfile reads any operator-chosen file with File.ReadAllBytes in SendFileInChunks before shipping it to the C2.Screen Capture
ExfilDesktopData copies the screen into a bitmap with BitBlt from the desktop window’s DC, draws the cursor on it, encodes it as JPEG and sends it under the RD+ tag.Command and Control
Non-Application Layer Protocol
The RAT talks to
130.12.181.70:7000 over a raw TCP Socket, sending length-prefixed, Violet-delimited messages that start with an INFO beacon, with no application layer protocol on top.Ingress Tool Transfer
The
LN and FURL commands fetch files from operator URLs with WebClient.DownloadFile and My.Computer.Network.DownloadFile, while sendfileto and DW write Base64 files pushed over the C2 socket to disk.Encrypted Channel: Symmetric Cryptography
SendEncryptedMessage encrypts every outgoing message with RijndaelManaged in ECB mode, keyed with the MD5 hash of the XSXSXSX constant, and AESDecrypt reverses it on each received command.Exfiltration
Exfiltration Over C2 Channel
SendFileInChunks splits a file into 32 KB Base64 chunks tagged filechunk and sends them with SendEncryptedMessage over the C2 socket, the same channel that carries screenshots and shell output.Exfiltration Over Alternative Protocol
The
UPtoS command calls My.Computer.Network.UploadFile to send a local file to an operator-supplied URL, so the data leaves over that URL’s protocol instead of the raw TCP C2 socket.