How blacktopservices/nuclear-rat works
Nuclear-Rat is a Windows remote-administration client: it connects to a remote controller, identifies the client, and supports controller-requested administration and monitoring tasks. The README also documents TLS/TCP transport, file and process management, remote desktop and shell, registry and startup management, a SOCKS5 reverse proxy, and browser/FTP password recovery. The supplied excerpts show transport, selected handlers, setup, and recovery internals; message dispatch and several feature implementations are not sampled, so their wiring is not asserted.
Main entry points: QuasarClient.cs Client session · ReverseProxyClient.cs Proxy connections · Recovery Browser and FTP readers · ClientInstaller.cs Client installer
Components 25
Client runtime
- Windows entry point
Nuclear.Client/Program.cs - Client application
Nuclear.Client/QuasarApplication.cs - Client session
Nuclear.Client/Networking/QuasarClient.cs - TLS TCP transport
Nuclear.Client/Networking/Client.cs
Remote administration
- File manager
Nuclear.Client/Messages/FileManagerHandler.cs - Task manager
Nuclear.Client/Messages/TaskManagerHandler.cs - Startup manager
Nuclear.Client/Messages/StartupManagerHandler.cs - Registry editor
Nuclear.Client/Registry/RegistryEditor.cs - Proxy handler
Nuclear.Client/Messages/ReverseProxyHandler.cs - Proxy connections
Nuclear.Client/ReverseProxy/ReverseProxyClient.cs - Remote desktop
Nuclear.Client/Messages/RemoteDesktopHandler.cs - Remote shell
Nuclear.Client/Messages/RemoteShellHandler.cs - System information
Nuclear.Client/Messages/SystemInformationHandler.cs - Keylogger
Nuclear.Client/Logging/KeyloggerService.cs
Credential recovery
- Browser and FTP readers
Nuclear.Client/Recovery - SQLite reader
Nuclear.Client/Recovery/Utilities/SQLiteHandler.cs
Setup and identity
- Client installer
Nuclear.Client/Setup/ClientInstaller.cs - Startup integration
Nuclear.Client/Setup/ClientStartup.cs - Geolocation lookup
Nuclear.Client/IpGeoLocation/GeoInformationRetriever.cs - User account
Nuclear.Client/User/UserAccount.cs
Other components
- Remote controller
- Windows host
- Controller endpoint
- SOCKS5 targets
- IP geolocation services
Connections 23
- Windows entry point → Client application: starts
- Client application → Client session: runs
- Client session → TLS TCP transport: connects through
- TLS TCP transport → Controller endpoint: TLS TCP stream
- Remote controller → Controller endpoint: issues requests
- Client session → Geolocation lookup: gets location
- Client session → User account: gets account
- Geolocation lookup → IP geolocation services: queries optionally
- File manager → Windows host: reads and changes files
- Task manager → Windows host: enumerates and starts processes
- Startup manager → Windows host: changes startup entries
- Registry editor → Windows host: edits registry
- Proxy handler → Proxy connections: manages connections
- Proxy connections → Controller endpoint: relays data
- Proxy connections → SOCKS5 targets: connects and forwards
- Remote desktop → Windows host: captures desktop
- Remote shell → Windows host: runs shell commands
- System information → Windows host: collects information
- Keylogger → Windows host: records keystrokes
- Browser and FTP readers → SQLite reader: reads database data
- Browser and FTP readers → Windows host: reads local credentials
- Client installer → Startup integration: configures startup
- Client installer → Windows host: installs client