VioletWorm - game.exe

Code Analysis of game.exe

Opening the file in pestudio shows that it is a .NET binary, so the analysis can move directly to dnSpy. pestudio also shows that the sample is 32-bit, so dnSpy x32 can be used. Once opened, the sample is named VioletClient, and many namespaces named Google<something> are shown, although they all appear to be empty. To find the code, move the sample to REMnux and run:

1
ilspycmd game.exe > /tmp/1

Opening the resulting file 1 with vim and searching for namespace lets us jump through every “namespace” keyword found, using the key n to move to the next occurrence. It turns out that namespace My and namespace XKTOtiYkqb are the only two that contain any code.

While we are in the text editor, it is useful to give both namespaces a quick glance. My looks more like a setup class where some of the parameters are defined. For example:

1
  private static readonly ThreadSafeObjectProvider<My.MyComputer> Lr2GHtiVyoYAjYteePTqGoogle = new ThreadSafeObjectProvider<My.MyComputer>();
2
  private static readonly ThreadSafeObjectProvider<My.MyApplication> lrykVu5OpO2siNCinTFnGoogle = new ThreadSafeObjectProvider<My.MyApplication>();
3

4
  private static readonly ThreadSafeObjectProvider<User> SUswyNrS6QQYOHYTshlNGoogle = new ThreadSafeObjectProvider<User>();
5
  private static readonly ThreadSafeObjectProvider<MyWebServices> X46kW6S5VKrVK670yClIGoogle = new ThreadSafeObjectProvider<MyWebServices>();
6

7
  internal static My.MyComputer Nz6xILpFqmXnzgMwgSspGoogle {
8
    get { return Lr2GHtiVyoYAjYteePTqGoogle.GetInstance; }
9
  }
10

11
  internal static My.MyApplication zH8qaub9gcFWHIvphGb3Google {
12
    get { return lrykVu5OpO2siNCinTFnGoogle.GetInstance; }
13
  }
14

15
  internal static User uE2Ar1jjH95MdlJG0gWNGoogle {
16
    get { return SUswyNrS6QQYOHYTshlNGoogle.GetInstance; }
17
  }

The My namespace therefore appears to be used by the second namespace, which is full of Base64-like strings. Each class now needs to be analyzed.

In dnSpy, I renamed the namespace XKTOtiYkqb to Core to make it easier to identify when referenced. From this point on, I will use that name.