How nyan-x-cat/lime-rat works
LimeRAT is a Windows remote-administration tool with a client payload, a server control application, and a collection of feature plugins. Its documented workflow is an operator using the server to communicate with a client; the README says that communication is AES-encrypted and describes a plugin system. The graph retains the major advertised capabilities, but source excerpts were unavailable, so feature-to-handler dispatch and most internal call relationships cannot be verified and are not asserted.
Main entry points: Forms Control interface · S_TcpListener.vb Connection listener · C_TcpClient.vb Client transport · C_Main.vb Client runtime
Components 19
Control application
- Control interface
Project/Server/Forms - Connection listener
Project/Server/Classes/S_TcpListener.vb - Server encryption
Project/Server/Classes/S_Encryption.vb - Server settings
Project/Server/Classes/S_Settings.vb
Client agent
- Client runtime
Project/Client/C_Main.vb - Client transport
Project/Client/C_TcpClient.vb - Client encryption
Project/Client/C_Encryption.vb - Client settings
Project/Client/C_Settings.vb
Client capabilities
- Persistence and USB
Project/Client/C_Installation.vb - Virtual-machine checks
Project/Client/C_AntiVM.vb - Data collection
Project/Plugins - Remote operations
Project/Server/Forms - Ransomware capability
Project/Server/Forms/Ransomware.vb - Monero miner
Project/Plugins/XMR - DDoS capability
Project/Plugins/DDOS
Plugins
- Plugin implementations
Project/Plugins - Crypto tools
Project/Plugins/CRYP - Encryption tools
Project/Plugins/ENC
Other components
- Operator
Connections 8
- Operator → Control interface: uses
README.md - Control interface → Connection listener: controls connections
- Connection listener → Client transport: communicates
README.md - Client transport → Client encryption: uses AES
README.md - Connection listener → Server encryption: uses AES
README.md - Client runtime → Client transport: uses transport
- Client runtime → Plugin implementations: loads plugins
README.md - Control interface → Remote operations: offers controls