Remote Access Trojan
VenomRAT - ClientAny.exe
- Author
- Moise Medici
- Updated
- 15 Nov 2025 · Completed
- Difficulty
- Easy
- Platform
- Family
- Languages
- MITRE
MITRE ATT&CK
Execution
Command and Scripting Interpreter: Windows Command Shell
NormalStartup.Install runs cmd /c schtasks /create /f /sc onlogon /rl highest ..., then executes a generated batch file (tmp8A48.tmp.bat) that runs timeout 3 > NUL, starts %AppData%\dadada.exe and deletes itself.Persistence
Scheduled Task/Job: Scheduled Task
When
Methods.IsAdmin() is true, the installer creates the logon task dadada with schtasks /create /f /sc onlogon /rl highest /tn "dadada" pointing at %AppData%\dadada.exe, which appeared in Task Scheduler during the admin run.Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
As a standard user, the installer writes the value
dadada = "C:\Users\REM\AppData\Roaming\dadada.exe" under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\, confirmed by a Procmon RegSetValue event.Stealth
Obfuscated Files or Information: Fileless Storage
Plugins pushed by the C2 are kept as compressed DLL bytes in registry values under
HKCU\Software\<Hw_id> through SetRegistry.SetValue, and Invoke reads them back from there instead of from a file on disk.Obfuscated Files or Information: Encrypted/Encoded File
The sensitive fields of
Client.Settings (Hos_ts, Por_ts, MTX, Paste_bin, Certifi_cate and others) are stored as Base64 AES-256 ciphertext, so the dead drop URL, mutex name and pinned certificate are not visible as plain strings.Indicator Removal: File Deletion
The installer’s batch file ends with
DEL "<its own name>" /f /q to remove itself from %TEMP%, and the keylogger deletes DataLogs_keylog_online.txt and DataLogs_keylog_offline.txt once their content has been sent to the C2.Deobfuscate/Decode Files or Information
At startup
Settings.InitializeSettings Base64-decodes Settings.Key and runs Aes256.Decrypt on each config field, recovering the paste URL, the mutex name dadadada and the server certificate that VerifyHash then checks.Execution Guardrails: Mutual Exclusion
Program.Main calls MutexControl.CreateMutex() and exits with Environment.Exit(0) when the mutex is already held, so only one instance runs per host (the decrypted MTX setting is dadadada).Hide Artifacts: Hidden Window
Both the
cmd process that registers the scheduled task and the self-deleting batch file are started with WindowStyle = ProcessWindowStyle.Hidden and CreateNoWindow = true, so no console window appears to the user.Reflective Code Loading
ClientSocket.Invoke decompresses the plugin bytes with Zip.Decompress, loads them with AppDomain.CurrentDomain.Load, instantiates Plugin.Plugin through Activator.CreateInstance and calls its Run method entirely in memory.Discovery
Application Window Discovery
The keylogger tags each burst of keystrokes with
GetActiveWindowTitle() and GetActiveProcessName(), and IdSender.SendInfo reports the foreground window title to the C2 in the Perfor_mance field.System Owner/User Discovery
IdSender.SendInfo sends Environment.UserName in the User field and the result of Methods.IsAdmin() as Admin or User, telling the operator which account and privilege level is infected.Process Discovery
CGRInfo.GetUserProcessList() lists running processes for the running field of ClientInfo and for the runningapp and filterinfo commands; the installer also walks Process.GetProcesses() to kill older copies of itself.System Information Discovery
IdSender.SendInfo collects Environment.MachineName, the OS name and bitness from ComputerInfo().OSFullName, a generated HWID, and CPU, GPU and RAM details from CGRInfo.GetCPUName, GetGPU and GetRAM.Peripheral Device Discovery
IdSender.SendInfo checks for an attached camera with Camera.havecamera() and reports the result to the C2 in the Camera field of the ClientInfo packet.Software Discovery
CGRInfo.GetInstalledApplications() collects the installed programs and sends them as apps in the ClientInfo packet and again in replies to the C2 filterinfo command.Software Discovery: Security Software Discovery
Methods.Antivirus() returns the installed antivirus product, sent as Anti_virus in ClientInfo; the sample carries the matching WMI query Select * from AntivirusProduct against \root\SecurityCenter2.Collection
Input Capture: Keylogging
Keylogger.SetHook installs a WH_KEYBOARD_LL hook with SetWindowsHookEx, and HookCallback turns each key into text through MapVirtualKey, GetKeyboardLayout and ToUnicodeEx, honoring Shift and Caps Lock.Data Staged: Local Data Staging
Keylogger.Log appends captured keystrokes to %AppData%\MyData\DataLogs_keylog_offline.txt and, while connected, DataLogs_keylog_online.txt, where they wait until SendLog or the loadofflinelog command ships them.Command and Control
Non-Application Layer Protocol
ClientSocket.InitializeClient opens a raw TCP Socket to the C2 and exchanges MsgPack messages framed by a 4-byte length header (HeaderSize = 4), a custom protocol rather than HTTP or another application-layer protocol.Web Service: Dead Drop Resolver
Because
Paste_bin is set, InitializeClient fetches https://paste.ee/r/7467kw7n/0 with WebClient.DownloadString and splits the reply on : to get the C2 host and port, 1ri7zwh3k.localto.net:8301.Ingress Tool Transfer
The
save_Plugin command delivers a compressed plugin DLL in its Dll field, which the client stores and then runs; plu_gin asks the server for any missing plugin with a sendPlugin packet.Encrypted Channel: Asymmetric Cryptography
The TCP socket is wrapped in an
SslStream and authenticated with AuthenticateAsClient, while ValidateVenomServer accepts only the server certificate pinned in the decrypted Certifi_cate setting.