They have the server software. There's a couple ways they could get it. 1.) They could have hacked the C2 server or a development network, like you are talking about. 2.) The server could be forward deployed to a cloud provider or other infrastructure and law enforcement served a subpoena for a copy of the cloud server. The second seems just as likely as the first.
They know specific commands and configurations for the "drobovur-server" which is the "Command and Control (C2) Server." This makes me think they have the actual server software and probably some sort of operational deployment.
the point wasnt whether or not they could or did. the point was that it could be inferred based on what sql client the malware client was using without ever touching the sever.
Read the document. They have the server software. They have configuration files for the server, they know how it processes communication, they know how it generates UUID's. They have the server software.