Malware

Pepesoft

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1195Supply Chain CompromiseEvidence1

Eleven NuGet packages advertised as game utilities and cheat panels downloaded a Windows payload named pepesoft.exe ... The packages were published as .NET command-line tools, so installing and running the tool command was enough to start a downloader chain.

Execution

3 techniques

T1059.001PowerShellEvidence1

Review process and PowerShell history. Look for hidden PowerShell that runs Start-Service w32time; w32tm /resync , unexpected cmd.exe /C launches, and .NET tool processes making network requests.

T1059.003Windows Command ShellEvidence1

Review process and PowerShell history. Look for hidden PowerShell that runs Start-Service w32time; w32tm /resync , unexpected cmd.exe /C launches, and .NET tool processes making network requests.

T1204User ExecutionEvidence1

The packages were published as .NET command-line tools, so installing and running the tool command was enough to start a downloader chain.

Stealth

3 techniques

T1036MasqueradingEvidence1

They presented themselves as tools for Albion Online, GTA5RP, GrandRP, Majestic RP, RMRP, Amazing RP, Lineage 2, Throne and Liberty, Russian Fishing 4, trigger-bot use, and a calculator-themed utility.

T1070Indicator RemovalEvidence1

Socket documented hardware fingerprinting, Google Sheets telemetry, operator-controlled ban lists, cloud configuration, Telegram screenshot delivery in some builds, and cleanup routines that can remove local files.

T1497Virtualization/Sandbox EvasionEvidence1

Ten of the 11 downloaders also requested elevation to resync the Windows clock before network activity.

Discovery

3 techniques

T1033System Owner/User DiscoveryEvidence1

The confirmed behavior included cloud configuration retrieval, Google Sheets licensing and telemetry, hardware ID binding, a remote ban list, and richer host reporting in the direct-bytecode applications.

T1082System Information DiscoveryEvidence1

Socket documented hardware fingerprinting ... The payloads also tracked device identity. They read hardware values, stored activation and runtime state through Google Sheets, and compared hosts against a remote banned worksheet.

T1497Virtualization/Sandbox EvasionEvidence1

Ten of the 11 downloaders also requested elevation to resync the Windows clock before network activity.

Collection

2 techniques

T1074Data StagedEvidence1

Local artifacts %LOCALAPPDATA%\Windows Src , %APPDATA%\pepesoft , ./libgg/chat_ids.txt , ./token.txt , credentials.txt Paths and files Socket recommends hunting after execution.

T1113Screen CaptureEvidence1

Those commands could send screenshots of a game window, the Pepesoft application window, or, in at least one path, the full screen.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

The payload staging used GitHub Releases and Hugging Face, both legitimate services that can blend into normal traffic ... stored activation and runtime state through Google Sheets.

T1105Ingress Tool TransferEvidence1

The first stage was a .NET downloader stored under tools/net8.0/any/ . It printed updater-like Russian console messages, created a shared mutex, and downloaded pepesoft.exe from GitHub Releases or Hugging Face paths under the username pepegit666 .

T1568Dynamic ResolutionEvidence1

The downloader resolved GitHub hosts through dns.google/resolve instead of the system resolver. That detail matters because hosts-file blocks or local DNS sinkholes may not catch the download request.

Exfiltration

1 technique

T1567Exfiltration Over Web ServiceEvidence1

Socket documented ... Google Sheets telemetry ... Telegram screenshot delivery in some builds ... Those commands could send screenshots of a game window, the Pepesoft application window, or, in at least one path, the full screen.

INDICATORS OF COMPROMISE

IOCs tracked for this family

4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

ip.v4●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

trojan killer newsNews

Jul 15, 2026

Game-Cheat NuGet Tools Dropped Pepesoft Windows Payload

A Windows second-stage payload delivered by malicious NuGet game utility packages. It performs hardware fingerprinting, retrieves cloud configuration, uses Google Sheets for licensing/telemetry, enforces remote ban lists, can deliver screenshots via Telegram in some builds, and includes cleanup routines that can remove local files.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching4

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Pepesoft

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1195Supply Chain CompromiseEvidence1

Execution

3 techniques

T1059.001PowerShellEvidence1

Review process and PowerShell history. Look for hidden PowerShell that runs Start-Service w32time; w32tm /resync , unexpected cmd.exe /C launches, and .NET tool processes making network requests.

T1059.003Windows Command ShellEvidence1

Review process and PowerShell history. Look for hidden PowerShell that runs Start-Service w32time; w32tm /resync , unexpected cmd.exe /C launches, and .NET tool processes making network requests.

T1204User ExecutionEvidence1

The packages were published as .NET command-line tools, so installing and running the tool command was enough to start a downloader chain.

Stealth

3 techniques

T1036MasqueradingEvidence1

T1070Indicator RemovalEvidence1

T1497Virtualization/Sandbox EvasionEvidence1

Ten of the 11 downloaders also requested elevation to resync the Windows clock before network activity.

Discovery

3 techniques

T1033System Owner/User DiscoveryEvidence1

T1082System Information DiscoveryEvidence1

T1497Virtualization/Sandbox EvasionEvidence1

Ten of the 11 downloaders also requested elevation to resync the Windows clock before network activity.

Collection

2 techniques

T1074Data StagedEvidence1

Local artifacts %LOCALAPPDATA%\Windows Src , %APPDATA%\pepesoft , ./libgg/chat_ids.txt , ./token.txt , credentials.txt Paths and files Socket recommends hunting after execution.

T1113Screen CaptureEvidence1

Those commands could send screenshots of a game window, the Pepesoft application window, or, in at least one path, the full screen.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

The payload staging used GitHub Releases and Hugging Face, both legitimate services that can blend into normal traffic ... stored activation and runtime state through Google Sheets.

T1105Ingress Tool TransferEvidence1

T1568Dynamic ResolutionEvidence1

Exfiltration

1 technique

T1567Exfiltration Over Web ServiceEvidence1

INDICATORS OF COMPROMISE

IOCs tracked for this family

4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

ip.v4●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

trojan killer newsNews

Jul 15, 2026

Game-Cheat NuGet Tools Dropped Pepesoft Windows Payload

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching4

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.