11 Malicious NuGet Game-Tool Packages Download Windows Payloads with Surveillance and Remote-Control Features
Summary
Socket researchers analyzed 11 NuGet game-tool packages that download and execute Windows payloads. The malware collects host and hardware data; three variants also support Telegram screenshots and remote commands.
Key points
- All 11 .NET command-line tools pose as game utilities and download pepesoft.exe from GitHub Releases or Hugging Face; their built-in BitTorrent fallback is dormant in the analyzed samples.
- Ten downloaders request elevation to resync the Windows clock, and the downloaders resolve GitHub hosts through Google DNS-over-HTTPS.
- The payloads retrieve remote configuration and use Google Sheets for telemetry, licensing, hardware binding, and a remote device ban-list.
- Three variants include Telegram commands that can capture and send screenshots and control game-related actions; the other eight do not contain these handlers.
- Eight PyArmor-protected payloads can route Google Sheets traffic through an authenticated proxy if direct connections fail.
- The three direct-bytecode variants can modify Windows Installer policy values and include an optional cleanup path that may delete files and folders in the application's working directory.
- Socket reported the packages to NuGet and requested their removal and the publisher account's suspension; the article also provides indicators and remediation guidance.
Article Details
- Attack Vectors
- Eleven malicious NuGet DotnetTool packages masquerade as game utilities and download and execute pepesoft.exe from attacker-controlled GitHub Releases or Hugging Face resources.
- The downloaders resolve GitHub hosts through Google DNS-over-HTTPS rather than the system resolver. Ten of the eleven also request elevation to resynchronize the Windows clock before downloading.
- The payload retrieves configuration through a Cloudflare Worker and falls back to an operator bucket on Selectel S3-compatible storage. Eight PyArmor-protected payloads can route Google Sheets traffic through a hardcoded authenticated HTTP proxy.
- The payloads report licensing and host information to Google Sheets and check hardware identifiers against a remote ban-list. In the Albion, Calculator, and Throne builds, Telegram bot commands can capture and send screenshots and control game-related functions.
- In the direct-bytecode Albion, Calculator, and Throne builds, an exit option can alter Windows Installer registry values and conditionally delete files and subdirectories from the application’s current directory.
- Defensive Notes
- Avoid installing NuGet tools advertised as game cheats, trainers, or panels; inspect DotnetTool package contents and vet dependencies before installation.
- Alert on unknown dotnet tool install activity, hidden PowerShell children of .NET tools invoking w32tm /resync, .NET processes requesting dns.google/resolve, and processes reading AWS_CONFIG_KEY.
- Block the listed payload-staging URLs, Cloudflare Worker endpoint, Selectel S3-compatible endpoint, authenticated proxy IP, and operator storefront or channel resources where appropriate.
- Hunt for the shared mutex GUID and key values, pepesoft.exe, the listed hashes, and the article’s noted paths including %LOCALAPPDATA%\Windows Src, %APPDATA%\pepesoft, ./libgg/chat_ids.txt, and ./token.txt.
- If a package was installed, uninstall it, remove associated payload and working directories, and rotate credentials that were entered into the tool or may have appeared in captured screenshots.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | bots[.]pepesoft[.]ru | Operator storefront associated with the paid game-automation operation behind the packages. |
| DOMAIN | calm-voice-9797[.]888c888x888[.]workers[.]dev | Operator Cloudflare Worker endpoint used to retrieve payload configuration. |
| DOMAIN | s3[.]ru-3[.]storage[.]selcloud[.]ru | S3-compatible endpoint used by the payload to retrieve configuration from the operator’s bucket. |
| IPV4 | 196[.]16[.]3[.]71 | Hardcoded authenticated proxy used by eight payloads as a fallback route for Google Sheets traffic. |
| SHA256 | 011926de3d0cc2b970627b9bf0de003e731f8576602dff756d2ab54a9de61972 | SHA-256 hash of the rmrp.dll first-stage downloader. |
| SHA256 | 01d2afea0f2201a3b59765a1a60ba324ff4b8fdd25f23a0e05824b97f195b27c | SHA-256 hash of the recovered PyArmor-protected Trigger gtaobus.pyc entrypoint. |
| SHA256 | 17b1d836c2f15a97be0350879943b04e14bc076cf09e31df0d73258ee10f7e7c | SHA-256 hash of the recovered PyArmor-protected Russian Fishing 4 gtaobus.pyc entrypoint. |
| SHA256 | 23808e7638f7a00b1ef9b9f4ca524f8a46cf63be6f6b79fec8e4a3fd1cc82a1e | SHA-256 hash of the trigger.dll first-stage downloader. |
| SHA256 | 23e4d8af5425dae022793450190c8d30809b2986dd879eb4bff557cdacf49c86 | SHA-256 hash of the recovered PyArmor-protected GrandRP gtaobus.pyc entrypoint. |
| SHA256 | 2a4fed04d792b9c2fdf9c1456a08ca23eda5fef50c0b409ab294ad489e12d801 | SHA-256 hash of the recovered PyArmor-protected Lineage 2 gtaobus.pyc entrypoint. |
| SHA256 | 476c6f36a22156e53548a87291989a21d6c905dcbd9e1bf68ff5bc12e5c8bb07 | SHA-256 hash of the Throne payload’s gtaobus.pyc entry module. |
| SHA256 | 4d13f1136b13c871c65141b77ec7208488334ac4be511800196adcd328666305 | SHA-256 hash of the majestic.dll first-stage downloader. |
| SHA256 | 567952daf0ab7b36b017aac9963791188dea0fbf2e99c7cc6f6652ee540f4840 | SHA-256 hash of the Albion payload’s gtaobus.pyc entry module. |
| SHA256 | 5d9843126db4223dc2a8a9cd4a627286fe1a6345e33b28e9c98b5fe56fe89da6 | SHA-256 hash of the RMRP pepesoft.exe second-stage payload. |
| SHA256 | 5f3a9ebf7039097b3cdbca8609b5b68af07eeb1dbf716ba2817a97fc7c543854 | SHA-256 hash of the setup.dll first-stage downloader in the Throne package. |
| SHA256 | 6c1f828e4d8395dde8293868c65ba8d86b3b9672ebbbb16e932624706d37d832 | SHA-256 hash of the Lineage 2 pepesoft.exe second-stage payload. |
| SHA256 | 6cbd4bc491deb11040e2b2f91b0b4e129af551a802fc78cb42e0e985297ef44c | SHA-256 hash of the Majestic pepesoft.exe second-stage payload. |
| SHA256 | 6eefe9d5f030d403c72bd4e4caf5bbb9dbc2bd5e15ebb07de153494f458e5eb9 | SHA-256 hash of the GrandRP pepesoft.exe second-stage payload. |
| SHA256 | 774e40046f353e3f916f39e3d13d6499da35705a479cfb89288c21017aaf5461 | SHA-256 hash of the recovered PyArmor-protected Amazing RP gtaobus.pyc entrypoint. |
| SHA256 | 79c09e1ffb4804c14ff27d41ec08d4390455c92d65717be0aeeec2697297d76a | SHA-256 hash of the rusfish4.dll first-stage downloader. |
| SHA256 | 7e42d25e707d29d5d185a4c5dc71019f744e88a30b66bbf06949194ff32dbc48 | SHA-256 hash of the recovered PyArmor-protected Majestic gtaobus.pyc entrypoint. |
| SHA256 | 8ab256dd839aec6638cd46374f4a6664e534b9341bbcdfd9b763e5a27c51ddb7 | SHA-256 hash of the GTA5RP pepesoft.exe second-stage payload. |
| SHA256 | 900ddb81d27e03967209fee4d17d13deb68eef0e1f10936eb520ca10575cb49e | SHA-256 hash of the calculator.dll first-stage downloader. |
| SHA256 | 95577498d23fe750221a5badfc25b5e9f020dcf4d80c79a019b090e3c3b0a32a | SHA-256 hash of the recovered PyArmor-protected GTA5RP gtaobus.pyc entrypoint. |
| SHA256 | 9a2091e6625fc11cfd8f39c17aa271604e66322ee045028946274b988103e35b | SHA-256 hash of the amazingrp.dll first-stage downloader. |
| SHA256 | a2a5e473dba85959b21b7e8a184bc255d5f2dacdf7411b91d212fb1217d2518b | SHA-256 hash of the Trigger pepesoft.exe second-stage payload. |
| SHA256 | ab58a90eb3682c6dc3389cd700a64f68a19c0dac3d0fa8e3df97ae041f96d4e1 | SHA-256 hash of the grandrp.dll first-stage downloader. |
| SHA256 | c9f3e7766dbe728d84a1243447faa5f5eba0645bf13089074d128ea7663e7f5b | SHA-256 hash of the Russian Fishing 4 pepesoft.exe second-stage payload. |
| SHA256 | cc853b3e4504c890d275ac2327f18acd7e4c5b99ca056181f3f5694781f2cf45 | SHA-256 hash of the Calculator payload’s gtaobus.pyc entry module. |
| SHA256 | d5385526f2f3e52c7d96087611c6cd4e479bf61828400efdb3ca09406d981609 | SHA-256 hash of the albion.dll first-stage downloader. |
| SHA256 | d59e1914d76499fa51bf861f418c84bda0b48913dc39bd2e73756e326e4ccbb0 | SHA-256 hash of the recovered PyArmor-protected RMRP gtaobus.pyc entrypoint. |
| SHA256 | d9f7ca9f93a7d188d51db308877b15d0beae932ca0bf4705384fbedf54b454c1 | SHA-256 hash of the lineage2.dll first-stage downloader. |
| SHA256 | e6e1049158ceb1971c61388349c81fa6047a7aecb4ff2089ef54a50dcc35dbc0 | SHA-256 hash of the gta5rp.dll first-stage downloader. |
| SHA256 | e8c2618565aa31d7ffe909ebc99040bafcc0ea8df7f5d92fa673bb7ffacb14c9 | SHA-256 hash of the Amazing RP pepesoft.exe second-stage payload. |
| URL | hxxps[:]//github[.]com/pepegit666/123f53y45ysdf34 | Operator GitHub repository used to stage the campaign’s second-stage payloads. |
| URL | hxxps[:]//github[.]com/pepegit666/123f53y45ysdf34/releases/download/albion[.]onlinepanel/pepesoft[.]exe | Specific GitHub Releases payload-download URL used by a campaign downloader. |
| URL | hxxps[:]//huggingface[.]co/buckets/pepegit666 | Operator Hugging Face resource used as a mirror for payload staging. |
| URL | hxxps[:]//huggingface[.]co/buckets/pepegit666/albion[.]onlinepanel/resolve/pepesoft[.]exe?download=true | Specific Hugging Face payload-download URL used by a campaign downloader. |
MITRE ATT&CK
T1016 · System Network Configuration DiscoveryPayloads collect network-related information, including local connection counts, internet status, IP address, and geolocation when available.T1027.002 · Software PackingThe payloads are PyInstaller-packed, and eight entry modules are additionally protected with PyArmor.T1057 · Process DiscoveryThe direct-bytecode payloads record visible-window metadata including process names and window titles.T1059.001 · PowerShellTen downloaders launch hidden PowerShell to start Windows Time and force a clock resynchronization.T1059.003 · Windows Command ShellThe downloader launches the payload through cmd.exe, and payload shutdown routines generate batch-file commands.T1070.004 · File DeletionThe exitadaptive cleanup branch deletes files and directories from the application’s current directory.T1071.001 · Web ProtocolsThe downloaders and payloads use web requests for staging, configuration, Google Sheets traffic, and related communications.T1082 · System Information DiscoveryPayloads collect host and hardware details including Windows version, hostname, CPU, motherboard, GPU, and hardware identifiers.T1090.002 · External ProxyEight PyArmor-protected payloads use a hardcoded authenticated HTTP proxy when direct Google Sheets access fails.T1105 · Ingress Tool TransferThe NuGet downloaders retrieve pepesoft.exe from the operator’s GitHub or Hugging Face staging resources.T1112 · Modify RegistryThe direct-bytecode payloads can delete DisableLogging and DisableMSI values from Windows Installer policy registry keys.T1113 · Screen CaptureThe Albion, Calculator, and Throne payloads capture game-window, program-window, or full-screen screenshots.T1140 · Deobfuscate/Decode Files or InformationThe direct-bytecode payloads base64-decode, decompress, and decrypt embedded Python source before executing it.T1195.002 · Compromise Software Supply ChainThe malicious downloader packages were published to NuGet as DotnetTool game utilities.T1567 · Exfiltration Over Web ServiceRecovered code sends telemetry and host state to Google Sheets; the direct-bytecode builds also send screenshots through Telegram.T1608.001 · Upload MalwareThe operator staged pepesoft.exe as GitHub Releases assets and Hugging Face resources.
Vendors
Cloudflareby the child pepesoft.exe. Two are AWS-style keys and the third is an endpoint URL pointing at a Cloudflare Worker. This is how the downloader configures the payload’s cloud-storage client without embeddingGitHuba first-stage downloader that fetches and executes a second-stage Windows payload named pepesoft.exe from GitHub Releases and Hugging Face paths under the username pepegit666, with dormant BitTorrent fallback codeGooglepayloads use downloader-supplied AWS-style key material to retrieve remote configuration, authenticate to Google Sheets, bind activations to hardware, and honor a remote HWID/UUID ban-list. In the three direct-bytecodeHugging Facethat fetches and executes a second-stage Windows payload named pepesoft.exe from GitHub Releases and Hugging Face paths under the username pepegit666, with dormant BitTorrent fallback code built in.SelectelRMRP, Russian Fishing 4), staging uses .su/.ru TLDs, and the S3 fallback runs on Russian provider Selectel (s3[.]ru-3[.]storage[.]selcloud[.]ru ). These are language, targeting, and infrastructure indicators of
Products
DotnetToolSocket’s Threat Research Team analyzed 11 malicious NuGet packages published as .NET command-line tools (DotnetTool package type) that present themselves as game utilities, bots, and “panels”. Every package is aGitHub Releasesdownloader that fetches and executes a second-stage Windows payload named pepesoft.exe from GitHub Releases and Hugging Face paths under the username pepegit666, with dormant BitTorrent fallback code built in.Google Sheetsuse downloader-supplied AWS-style key material to retrieve remote configuration, authenticate to Google Sheets, bind activations to hardware, and honor a remote HWID/UUID ban-list. In the three direct-bytecodeHugging Facethat fetches and executes a second-stage Windows payload named pepesoft.exe from GitHub Releases and Hugging Face paths under the username pepegit666, with dormant BitTorrent fallback code built in.Microsoft Windowsbots, and “panels”. Every package is a first-stage downloader that fetches and executes a second-stage Windows payload named pepesoft.exe from GitHub Releases and Hugging Face paths under the username pepegit666,NuGetSocket’s Threat Research Team analyzed 11 malicious NuGet packages published as .NET command-line tools (DotnetTool package type) that present themselves as game utilities, bots, and “panels”. Every package is aPowerShellBefore any network activity, 10 of the 11 downloader assemblies spawn a hidden PowerShell process with the runas verb to start the Windows Time service and force a resync. The runas verb requests elevation, and thePyArmorto a single toolchain. The payload corpus contains recovered original pepesoft.exe files for the eight PyArmor-protected release tags, and each has a distinct hash. Three payloads, Albion, Calculator, and Throne,PyInstallerA PyInstaller-packed Python payload (pepesoft.exe). The recovered payloads use downloader-supplied AWS-style key material to retrieve remote configuration, authenticate to Google Sheets, bind activations to hardware,