# blacktopservices/nuclear-rat architecture

> Architecture diagram of the GitHub repository blacktopservices/nuclear-rat, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/blacktopservices/nuclear-rat
- Repository: https://github.com/blacktopservices/nuclear-rat

## Overview

Nuclear-Rat is a Windows remote-administration client: it connects to a remote controller, identifies the client, and supports controller-requested administration and monitoring tasks. The README also documents TLS/TCP transport, file and process management, remote desktop and shell, registry and startup management, a SOCKS5 reverse proxy, and browser/FTP password recovery. The supplied excerpts show transport, selected handlers, setup, and recovery internals; message dispatch and several feature implementations are not sampled, so their wiring is not asserted.

Main entry points: [`Nuclear.Client/Networking/QuasarClient.cs`](https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Networking/QuasarClient.cs) (Client session), [`Nuclear.Client/ReverseProxy/ReverseProxyClient.cs`](https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/ReverseProxy/ReverseProxyClient.cs) (Proxy connections), [`Nuclear.Client/Recovery`](https://github.com/blacktopservices/nuclear-rat/tree/Nuclear-rat-1.8/Nuclear.Client/Recovery) (Browser and FTP readers), [`Nuclear.Client/Setup/ClientInstaller.cs`](https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Setup/ClientInstaller.cs) (Client installer)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_runtime["Client runtime"]
  node_program["Windows entry point<br/>[Program.cs]"]
  node_application["Client application"]
  node_quasar["Client session<br/>[QuasarClient.cs]"]
  node_transport["TLS TCP transport<br/>[Client.cs]"]
end

subgraph group_admin["Remote administration"]
  node_filemgr["File manager"]
  node_taskmgr["Task manager"]
  node_startupmgr["Startup manager"]
  node_registry["Registry editor<br/>[RegistryEditor.cs]"]
  node_proxyhandler["Proxy handler"]
  node_proxyclient["Proxy connections"]
  node_desktop["Remote desktop"]
  node_shell["Remote shell"]
  node_systeminfo["System information"]
  node_keylogger["Keylogger"]
end

subgraph group_recovery["Credential recovery"]
  node_passwordreaders["Browser and FTP readers<br/>[Recovery]"]
  node_sqlite["SQLite reader<br/>[SQLiteHandler.cs]"]
end

subgraph group_setup["Setup and identity"]
  node_installer["Client installer<br/>[ClientInstaller.cs]"]
  node_startup["Startup integration<br/>[ClientStartup.cs]"]
  node_geo["Geolocation lookup"]
  node_account["User account<br/>[UserAccount.cs]"]
end

node_operator(("Remote controller"))
node_windows(("Windows host"))
node_controller(("Controller endpoint"))
node_proxytarget(("SOCKS5 targets"))
node_geoservice(("IP geolocation services"))

node_program -->|"starts"| node_application
node_application -->|"runs"| node_quasar
node_quasar -->|"connects through"| node_transport
node_transport -->|"TLS TCP stream"| node_controller
node_operator -->|"issues requests"| node_controller
node_quasar -->|"gets location"| node_geo
node_quasar -->|"gets account"| node_account
node_geo -.->|"queries optionally"| node_geoservice
node_filemgr -->|"reads and changes files"| node_windows
node_taskmgr -->|"enumerates and starts processes"| node_windows
node_startupmgr -->|"changes startup entries"| node_windows
node_registry -->|"edits registry"| node_windows
node_proxyhandler -->|"manages connections"| node_proxyclient
node_proxyclient -->|"relays data"| node_controller
node_proxyclient -->|"connects and forwards"| node_proxytarget
node_desktop -->|"captures desktop"| node_windows
node_shell -->|"runs shell commands"| node_windows
node_systeminfo -->|"collects information"| node_windows
node_keylogger -->|"records keystrokes"| node_windows
node_passwordreaders -->|"reads database data"| node_sqlite
node_passwordreaders -->|"reads local credentials"| node_windows
node_installer -->|"configures startup"| node_startup
node_installer -->|"installs client"| node_windows

click node_program "https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Program.cs"
click node_application "https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/QuasarApplication.cs"
click node_quasar "https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Networking/QuasarClient.cs"
click node_transport "https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Networking/Client.cs"
click node_filemgr "https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Messages/FileManagerHandler.cs"
click node_taskmgr "https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Messages/TaskManagerHandler.cs"
click node_startupmgr "https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Messages/StartupManagerHandler.cs"
click node_registry "https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Registry/RegistryEditor.cs"
click node_proxyhandler "https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Messages/ReverseProxyHandler.cs"
click node_proxyclient "https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/ReverseProxy/ReverseProxyClient.cs"
click node_desktop "https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Messages/RemoteDesktopHandler.cs"
click node_shell "https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Messages/RemoteShellHandler.cs"
click node_systeminfo "https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Messages/SystemInformationHandler.cs"
click node_keylogger "https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Logging/KeyloggerService.cs"
click node_passwordreaders "https://github.com/blacktopservices/nuclear-rat/tree/Nuclear-rat-1.8/Nuclear.Client/Recovery"
click node_sqlite "https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Recovery/Utilities/SQLiteHandler.cs"
click node_installer "https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Setup/ClientInstaller.cs"
click node_startup "https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Setup/ClientStartup.cs"
click node_geo "https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/IpGeoLocation/GeoInformationRetriever.cs"
click node_account "https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/User/UserAccount.cs"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_program,node_application,node_quasar,node_transport toneBlue
class node_filemgr,node_taskmgr,node_startupmgr,node_registry,node_proxyhandler,node_proxyclient,node_desktop,node_shell,node_systeminfo,node_keylogger toneAmber
class node_passwordreaders,node_sqlite toneMint
class node_installer,node_startup,node_geo,node_account toneRose
class node_operator,node_windows,node_controller,node_proxytarget,node_geoservice toneIndigo
```

## Components

### Client runtime

- [Windows entry point](https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Program.cs): `Nuclear.Client/Program.cs`
- [Client application](https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/QuasarApplication.cs): `Nuclear.Client/QuasarApplication.cs`
- [Client session](https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Networking/QuasarClient.cs): `Nuclear.Client/Networking/QuasarClient.cs`
- [TLS TCP transport](https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Networking/Client.cs): `Nuclear.Client/Networking/Client.cs`

### Remote administration

- [File manager](https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Messages/FileManagerHandler.cs): `Nuclear.Client/Messages/FileManagerHandler.cs`
- [Task manager](https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Messages/TaskManagerHandler.cs): `Nuclear.Client/Messages/TaskManagerHandler.cs`
- [Startup manager](https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Messages/StartupManagerHandler.cs): `Nuclear.Client/Messages/StartupManagerHandler.cs`
- [Registry editor](https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Registry/RegistryEditor.cs): `Nuclear.Client/Registry/RegistryEditor.cs`
- [Proxy handler](https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Messages/ReverseProxyHandler.cs): `Nuclear.Client/Messages/ReverseProxyHandler.cs`
- [Proxy connections](https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/ReverseProxy/ReverseProxyClient.cs): `Nuclear.Client/ReverseProxy/ReverseProxyClient.cs`
- [Remote desktop](https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Messages/RemoteDesktopHandler.cs): `Nuclear.Client/Messages/RemoteDesktopHandler.cs`
- [Remote shell](https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Messages/RemoteShellHandler.cs): `Nuclear.Client/Messages/RemoteShellHandler.cs`
- [System information](https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Messages/SystemInformationHandler.cs): `Nuclear.Client/Messages/SystemInformationHandler.cs`
- [Keylogger](https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Logging/KeyloggerService.cs): `Nuclear.Client/Logging/KeyloggerService.cs`

### Credential recovery

- [Browser and FTP readers](https://github.com/blacktopservices/nuclear-rat/tree/Nuclear-rat-1.8/Nuclear.Client/Recovery): `Nuclear.Client/Recovery`
- [SQLite reader](https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Recovery/Utilities/SQLiteHandler.cs): `Nuclear.Client/Recovery/Utilities/SQLiteHandler.cs`

### Setup and identity

- [Client installer](https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Setup/ClientInstaller.cs): `Nuclear.Client/Setup/ClientInstaller.cs`
- [Startup integration](https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/Setup/ClientStartup.cs): `Nuclear.Client/Setup/ClientStartup.cs`
- [Geolocation lookup](https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/IpGeoLocation/GeoInformationRetriever.cs): `Nuclear.Client/IpGeoLocation/GeoInformationRetriever.cs`
- [User account](https://github.com/blacktopservices/nuclear-rat/blob/Nuclear-rat-1.8/Nuclear.Client/User/UserAccount.cs): `Nuclear.Client/User/UserAccount.cs`

### Other components

- **Remote controller**
- **Windows host**
- **Controller endpoint**
- **SOCKS5 targets**
- **IP geolocation services**

## Connections

- Windows entry point → Client application: starts
- Client application → Client session: runs
- Client session → TLS TCP transport: connects through
- TLS TCP transport → Controller endpoint: TLS TCP stream
- Remote controller → Controller endpoint: issues requests
- Client session → Geolocation lookup: gets location
- Client session → User account: gets account
- Geolocation lookup → IP geolocation services: queries optionally
- File manager → Windows host: reads and changes files
- Task manager → Windows host: enumerates and starts processes
- Startup manager → Windows host: changes startup entries
- Registry editor → Windows host: edits registry
- Proxy handler → Proxy connections: manages connections
- Proxy connections → Controller endpoint: relays data
- Proxy connections → SOCKS5 targets: connects and forwards
- Remote desktop → Windows host: captures desktop
- Remote shell → Windows host: runs shell commands
- System information → Windows host: collects information
- Keylogger → Windows host: records keystrokes
- Browser and FTP readers → SQLite reader: reads database data
- Browser and FTP readers → Windows host: reads local credentials
- Client installer → Startup integration: configures startup
- Client installer → Windows host: installs client