# maxamin/craxsrat-v6.7-source-code architecture

> Architecture diagram of the GitHub repository maxamin/craxsrat-v6.7-source-code, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-06-22). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/maxamin/craxsrat-v6.7-source-code
- Repository: https://github.com/maxamin/craxsrat-v6.7-source-code

## Overview

1. **What this repository is**
   - This is a single Visual Studio solution for a **Windows desktop C# application** built with **WinForms** on **.NET Framework**.
   - Based on the README and the file names, it functions as the **builder/control panel** for an Android RAT, not as the Android payload itself.

2. **Top-level structure**
   - The repo is dominated by one project: `CraxsRat/`.
   - Most features are implemented as **form-based screens** with paired `.cs`, `.Designer.cs`, and `.resources` files, which indicates a highly UI-driven operator console.
   - `obj/` and `.vs/` are build/IDE artifacts and not part of the runtime architecture.

3. **Operator console as the center of the system**
   - The application appears to present a **central control interface** for managing infected devices.
   - Feature-specific windows include device, file, app, call, SMS, camera, microphone, location, clipboard, keylogger, shell, and screen modules.
   - This suggests a **command-and-control dashboard** pattern, where the user of the tool issues actions and views exfiltrated data.

4. **Remote device management subsystems**
   - Many forms map directly to device capabilities:
     - `ContactsManager`, `CallsManager`, `Calls_Records`, `SMSManager`, `TextMessage`
     - `FileManager`, `Download`, `Upload`
     - `CameraManager`, `Microphone`, `LocationManager`
     - `ScreenShoter`, `ScreenReader`, `ScreenReaderV2`, `ScreenLoger`
     - `Keylogger`, `KeyboardManager`, `ClipboardManager`
     - `Applications`, `AppsProperties`, `WebViewMonitor`, `Win_Users`
   - These likely represent the **commanding, viewing, and extraction** side of the malware.

5. **Payload builder and packaging path**
   - Files like `Build`, `Jector`, `Faker`, `CypherRat`, `requestapk`, `SelfRemove`, and `PermissionsManager` point to a **payload generation pipeline**.
   - The README explicitly mentions obfuscation, anti-removal, accessibility abuse, and Play Protect bypass, so this app likely **builds a customized APK** with embedded configuration and evasion features.

6. **Configuration and connection management**
   - `EditConnections`, `EditSocket`, `Ports`, `Settings`, `CraxsSettings`, `AccountManager`, and `LanguageSelector` indicate a dedicated **configuration layer** for how the panel and payload communicate.
   - The architecture likely stores operator preferences, connection parameters, and per-build options in local settings/resources rather than in a separate service.

7. **Communication/runtime core**
   - The generic classes (`Module0`–`Module13`, `GClass*`, `GModule*`, `NativeMethods*`, `GWebClient0`, `GProgressBar0`, `GRichTextBox0`, `GUserControl0`) suggest a **shared runtime library** used across the forms.
   - This layer likely contains the common networking, UI plumbing, marshaling, and platform interop used by the feature screens.

8. **Data flow**
   - The likely flow is:
     - operator configures a build or connection,
     - the builder produces an Android payload,
     - the payload connects back to the operator console,
     - feature modules exchange commands and results,
     - collected artifacts are displayed in the relevant forms or logs.
   - The forms `Report`, `craxscallslog`, `craxsnotification`, and `information` look like aggregation points for incoming device data.

9. **Persistence, evasion, and abuse features**
   - The README calls out accessibility exploitation, anti-removal, and Google Play Protect bypass.
   - In the UI, this is reflected by modules like `PermissionsManager`, `SelfRemove`, `DialogPloice`, `nonetform`, and `Faker`, which likely support stealth, permission prompts, and persistence-related workflows.
   - These are not separate services; they appear embedded into the same desktop control application.

10. **UI and resource architecture**
   - The project is resource-heavy: most forms have paired `.resources` files and designer-generated layouts.
   - This indicates a **large modal UI surface** rather than a small command-line or service-based backend.
   - Custom controls such as `GControl0`, `GProgressBar0`, `GRichTextBox0`, and `GUserControl0` suggest a reusable theming/UI toolkit inside the project.

11. **Boundary between desktop panel and Android target**
   - The repository shown here is the **Windows-side control and builder application**.
   - The Android target is implied by the README and the payload-building forms, but its source is not present as a separate project in this tree.
   - For an architecture diagram, it is useful to draw two major boundaries: **operator workstation app** and **infected Android device/payload**.

12. **Key takeaway for a diagram**
   - The architecture is best represented as a **single desktop WinForms control suite** with:
     - a configuration/build subsystem,
     - a communication layer,
     - many feature-specific device-control screens,
     - and shared runtime/helper classes underneath.
   - There is no evidence here of microservices or separate backend APIs; the control plane logic appears concentrated inside this one C# application.

Main entry points: [`CraxsRat/Module0.cs`](https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/Module0.cs) (Runtime), [`CraxsRat/Build.cs`](https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/Build.cs) (Build), [`CraxsRat/Report.cs`](https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/Report.cs) (Report), [`CraxsRat/Applications.cs`](https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/Applications.cs) (Apps)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_desktop_panel["Desktop Panel"]
  node_report["Report<br/>dashboard form<br/>[Report.cs]"]
  node_connections["Connections<br/>connection editor<br/>[EditConnections.cs]"]
  node_settings["Settings<br/>preferences form<br/>[CraxsSettings.cs]"]
  node_device_files["Files<br/>file manager<br/>[FileManager.cs]"]
  node_device_sms["SMS<br/>message manager<br/>[SMSManager.cs]"]
  node_device_media["Media<br/>camera and mic<br/>[CameraManager.cs]"]
  node_device_screen["Screen<br/>[ScreenShoter.cs]"]
  node_device_input["Input<br/>keylogger and clipboard<br/>[Keylogger.cs]"]
  node_device_shell["Shell<br/>[ShellTerminal.cs]"]
  node_device_apps["Apps<br/>app inventory<br/>[Applications.cs]"]
  node_device_identity["Identity<br/>contacts and calls<br/>[ContactsManager.cs]"]
  node_device_data["Data Views<br/>aggregated logs"]
end

subgraph group_build_pipeline["Build Pipeline"]
  node_build["Build<br/>[Build.cs]"]
  node_apk_request["APK Request<br/>payload template<br/>[requestapk.cs]"]
  node_hardening["Hardening<br/>evasion options"]
  node_cleanup["Cleanup<br/>self-removal<br/>[SelfRemove.cs]"]
  node_payload_branding["Branding<br/>disguise and coercion<br/>[Faker.cs]"]
end

subgraph group_shared_runtime["Shared Runtime"]
  node_runtime["Runtime<br/>shared core<br/>[Module0.cs]"]
  node_network["Network<br/>web client<br/>[GWebClient0.cs]"]
  node_ui_kit["UI Kit<br/>custom controls<br/>[GControl0.cs]"]
  node_interop["Interop<br/>native helpers<br/>[NativeMethods.cs]"]
end

subgraph group_target_payload["Android Payload"]
  node_payload{{"Payload<br/>android implant"}}
end

node_report -->|"surfaces"| node_device_data
node_report -->|"opens"| node_device_identity
node_report -->|"opens"| node_device_apps
node_connections -->|"feeds"| node_build
node_settings -->|"configures"| node_build
node_build -->|"starts"| node_apk_request
node_build -->|"applies"| node_hardening
node_build -->|"embeds"| node_cleanup
node_build -->|"packages"| node_payload_branding
node_apk_request -->|"emits"| node_payload
node_hardening -->|"shapes"| node_payload
node_cleanup -->|"modifies"| node_payload
node_payload_branding -->|"disguises"| node_payload
node_network -->|"communicates"| node_payload
node_runtime -->|"uses"| node_network
node_runtime -->|"uses"| node_ui_kit
node_runtime -->|"uses"| node_interop
node_runtime -->|"powers"| node_device_files
node_runtime -->|"powers"| node_device_sms
node_runtime -->|"powers"| node_device_media
node_runtime -->|"powers"| node_device_screen
node_runtime -->|"powers"| node_device_input
node_runtime -->|"powers"| node_device_shell
node_runtime -->|"powers"| node_device_apps
node_runtime -->|"powers"| node_device_identity
node_payload -->|"serves"| node_device_files
node_payload -->|"serves"| node_device_sms
node_payload -->|"serves"| node_device_media
node_payload -->|"serves"| node_device_screen
node_payload -->|"serves"| node_device_input
node_payload -->|"serves"| node_device_shell
node_payload -->|"serves"| node_device_apps
node_payload -->|"serves"| node_device_identity

click node_report "https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/Report.cs"
click node_connections "https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/EditConnections.cs"
click node_settings "https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/CraxsSettings.cs"
click node_device_files "https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/FileManager.cs"
click node_device_sms "https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/SMSManager.cs"
click node_device_media "https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/CameraManager.cs"
click node_device_screen "https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/ScreenShoter.cs"
click node_device_input "https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/Keylogger.cs"
click node_device_shell "https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/ShellTerminal.cs"
click node_device_apps "https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/Applications.cs"
click node_device_identity "https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/ContactsManager.cs"
click node_device_data "https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/craxsnotification.cs"
click node_build "https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/Build.cs"
click node_apk_request "https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/requestapk.cs"
click node_hardening "https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/PermissionsManager.cs"
click node_cleanup "https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/SelfRemove.cs"
click node_payload_branding "https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/Faker.cs"
click node_runtime "https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/Module0.cs"
click node_network "https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/GWebClient0.cs"
click node_ui_kit "https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/GControl0.cs"
click node_interop "https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/NativeMethods.cs"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_report,node_connections,node_settings,node_device_files,node_device_sms,node_device_media,node_device_screen,node_device_input,node_device_shell,node_device_apps,node_device_identity,node_device_data toneBlue
class node_build,node_apk_request,node_hardening,node_cleanup,node_payload_branding toneAmber
class node_runtime,node_network,node_ui_kit,node_interop toneMint
class node_payload toneRose
```

## Components

### Desktop Panel

WinForms operator console and its feature screens.

- [Report](https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/Report.cs): dashboard form · Central view for incoming device data and operator status. · `CraxsRat/Report.cs`
- [Connections](https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/EditConnections.cs): connection editor · Configures how the panel and payload communicate. · `CraxsRat/EditConnections.cs`
- [Settings](https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/CraxsSettings.cs): preferences form · Stores operator and application options. · `CraxsRat/CraxsSettings.cs`
- [Files](https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/FileManager.cs): file manager · Browse, download, and upload remote files. · `CraxsRat/FileManager.cs`
- [SMS](https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/SMSManager.cs): message manager · Views and manages device text messages. · `CraxsRat/SMSManager.cs`
- [Media](https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/CameraManager.cs): camera and mic · Captures camera and microphone streams. · `CraxsRat/CameraManager.cs`
- [Screen](https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/ScreenShoter.cs): screen monitor · Screenshots, screen reading, and log capture tools. · `CraxsRat/ScreenShoter.cs`
- [Input](https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/Keylogger.cs): keylogger and clipboard · Captures keystrokes, keyboard state, and clipboard data. · `CraxsRat/Keylogger.cs`
- [Shell](https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/ShellTerminal.cs): remote shell · Interactive command terminal for the remote device. · `CraxsRat/ShellTerminal.cs`
- [Apps](https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/Applications.cs): app inventory · Lists installed applications and their properties. · `CraxsRat/Applications.cs`
- [Identity](https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/ContactsManager.cs): contacts and calls · Contacts, call history, and related phone records. · `CraxsRat/ContactsManager.cs`
- [Data Views](https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/craxsnotification.cs): aggregated logs · Consolidated reports, notifications, and activity views. · `CraxsRat/craxsnotification.cs`

### Build Pipeline

Payload generation, packaging, and evasion-related configuration.

- [Build](https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/Build.cs): payload builder · Assembles a customized Android payload from operator choices. · `CraxsRat/Build.cs`
- [APK Request](https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/requestapk.cs): payload template · Initiates or prepares the APK generation flow. · `CraxsRat/requestapk.cs`
- [Hardening](https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/PermissionsManager.cs): evasion options · Permissions, anti-removal, and persistence-related build options. · `CraxsRat/PermissionsManager.cs`
- [Cleanup](https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/SelfRemove.cs): self-removal · Supports stealth and removal-related behavior after deployment. · `CraxsRat/SelfRemove.cs`
- [Branding](https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/Faker.cs): disguise and coercion · Faker, dialogs, and social-engineering themed build controls. · `CraxsRat/Faker.cs`

### Shared Runtime

Common UI, networking, and helper classes reused across forms.

- [Runtime](https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/Module0.cs): shared core · Common code for forms, networking, and interop. · `CraxsRat/Module0.cs`
- [Network](https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/GWebClient0.cs): web client · Shared client used for communication and requests. · `CraxsRat/GWebClient0.cs`
- [UI Kit](https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/GControl0.cs): custom controls · Reusable themed controls used across the WinForms surface. · `CraxsRat/GControl0.cs`
- [Interop](https://github.com/maxamin/craxsrat-v6.7-source-code/blob/main/CraxsRat/NativeMethods.cs): native helpers · Platform invoke and low-level Windows support code. · `CraxsRat/NativeMethods.cs`

### Android Payload

Conceptual target-side implant built and controlled by this application.

- **Payload**: android implant · Conceptual Android side that receives the build output and connects back.

## Connections

- Report → Data Views: surfaces · Operator dashboard displays aggregated logs and notifications.
- Report → Identity: opens · Dashboard links into phone identity, contacts, and call views.
- Report → Apps: opens · Dashboard links into application inventory.
- Connections → Build: feeds · Connection settings are used by the builder and payload configuration.
- Settings → Build: configures · Local preferences influence build and operator behavior.
- Build → APK Request: starts · Build flow requests or prepares the APK artifact.
- Build → Hardening: applies · Build pipeline includes permission and evasion options.
- Build → Cleanup: embeds · Build pipeline can include self-removal and stealth behavior.
- Build → Branding: packages · Build pipeline can disguise the payload and craft prompts.
- APK Request → Payload: emits · Builder produces the Android-side artifact.
- Hardening → Payload: shapes · Permissions and anti-removal settings affect the payload.
- Cleanup → Payload: modifies · Cleanup/self-removal logic is embedded into the payload.
- Branding → Payload: disguises · Social-engineering and fake UI elements are packaged into the payload.
- Network → Payload: communicates · Shared client underpins panel-to-payload traffic.
- Runtime → Network: uses · Core runtime depends on common communication helpers.
- Runtime → UI Kit: uses · Core runtime is rendered through custom controls.
- Runtime → Interop: uses · Core runtime relies on native Windows interop.
- Runtime → Files: powers · Shared core backs feature forms for remote file control.
- Runtime → SMS: powers · Shared core backs messaging features.
- Runtime → Media: powers · Shared core backs camera and microphone features.
- Runtime → Screen: powers · Shared core backs screen capture and screen log modules.
- Runtime → Input: powers · Shared core backs input-capture modules.
- Runtime → Shell: powers · Shared core backs the remote shell interface.
- Runtime → Apps: powers · Shared core backs app inspection screens.
- Runtime → Identity: powers · Shared core backs contacts and calls modules.
- Payload → Files: serves · Remote file operations act on the connected device.
- Payload → SMS: serves · Messaging data is retrieved from the connected device.
- Payload → Media: serves · Camera and microphone data come from the connected device.
- Payload → Screen: serves · Screen capture features operate on the connected device.
- Payload → Input: serves · Keystrokes and clipboard data are collected from the connected device.
- Payload → Shell: serves · Shell commands are executed on the connected device.
- Payload → Apps: serves · Application inventory is pulled from the connected device.
- Payload → Identity: serves · Contacts and call records are exposed by the connected device.