← Reports Remote Access Trojan · Worm · Dropper VioletWorm - game.exe Author Moise Medici Updated 07 Sept 2026 · Completed Difficulty Easy Platform Windows Languages PythonC# MITRE T1047 (Windows Management Instrumentation) T1059.001 (Command and Scripting Interpreter: PowerShell) T1059.003 (Command and Scripting Interpreter: Windows Command Shell) T1059.006 (Command and Scripting Interpreter: Python) T1053.005 (Scheduled Task/Job: Scheduled Task) T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder) T1027.009 (Obfuscated Files or Information: Embedded Payloads) T1027.013 (Obfuscated Files or Information: Encrypted/Encoded File) T1036.005 (Masquerading: Match Legitimate Resource Name or Location) T1070.004 (Indicator Removal: File Deletion) T1070.006 (Indicator Removal: Timestomp) T1140 (Deobfuscate/Decode Files or Information) T1480.002 (Execution Guardrails: Mutual Exclusion) T1497.003 (Virtualization/Sandbox Evasion: Time Based Checks) T1564.001 (Hide Artifacts: Hidden Files and Directories) T1564.003 (Hide Artifacts: Hidden Window) T1620 (Reflective Code Loading) T1112 (Modify Registry) T1553.005 (Subvert Trust Controls: Mark-of-the-Web Bypass) T1685 (Disable or Modify Tools) T1033 (System Owner/User Discovery) T1057 (Process Discovery) T1082 (System Information Discovery) T1083 (File and Directory Discovery) T1120 (Peripheral Device Discovery) T1518.001 (Software Discovery: Security Software Discovery) T1005 (Data from Local System) T1113 (Screen Capture) T1095 (Non-Application Layer Protocol) T1105 (Ingress Tool Transfer) T1573.001 (Encrypted Channel: Symmetric Cryptography) T1041 (Exfiltration Over C2 Channel) T1048 (Exfiltration Over Alternative Protocol) T1499.002 (Endpoint Denial of Service: Service Exhaustion Flood) Appendix 1 ↩ Github: PyInstaller Extractor 2 ↩ PyPi: uncompyle6 3 ↩ Github: depyo - Python bytecode decompiler in Node.js 4 ↩ Microsoft: Antimalware Scan Interface (AMSI) 5 ↩ Microsoft: AmsiScanBuffer function 6 ↩ Microsoft: VirtualProtect function 7 ↩ Microsoft: Memory Protection Constants 8 ↩ Linux Man Page: memmove(3) - Linux manual page 9 ↩ Medium: AMSI Bypass: In-memory patching 10 ↩ Windows: Event Tracing for Windows 11 ↩ Windows: EtwEventWrite function 12 ↩ Windows: Zone.Identifier Stream Name 13 ↩ Windows: SetFileAttribute function 14 ↩ Python Docs: subprocess - Subprocess management 15 ↩ Microsoft: Process Creation Flag 16 ↩ Microsoft: Manage connections from Windows 10 and Windows 11 operating system components to Microsoft services 16 ↩ Microsoft: System Error Codes (0-499) 17 ↩ Microsoft: Add-MpPreference 18 ↩ Microsoft: GetProcessWindowStation function 19 ↩ Microsoft: Window Stations 20 ↩ Microsoft: EnumDesktopsA function 21 ↩ Microsoft: GetDC function 22 ↩ Microsoft: BitBlt function 23 ↩ Microsoft: Device Contexts 24 ↩ Microsoft: OpenInputDesktop function 25 ↩ Microsoft: GetEncoding function 26 ↩ Microsoft: Socket.BeginReceive Method 27 ↩ Microsoft: Socket.Connect Method 28 ↩ Microsoft: WindowsPrincipal Class 29 ↩ Microsoft: capGetDriverDescriptionA function 30 ↩ Microsoft: ManagementObjectSearcher Class 31 ↩ Wikipedia: Advanced Encryption Standard 32 ↩ Microsoft: NewLateBinding.LateCall Method 33 ↩ Microsoft: Interaction.Shell(String, AppWinStyle, Boolean, Int32) Method 34 ↩ ConfuserEx Github: ConfuserEx Github Section 17 of 17: Appendix ← MITRE ATT&CK