thorthehacker111/curse_rat

Purpose and Entrypoints

CURSE RAT is an Android remote-administration/C2 system with a Node.js server, browser dashboard, APK builder, and Java Android client. The operational server entry point is server/server.js; APK modification/build orchestration is server/builder.js. The Android application begins through its manifest and UI/service lifecycle in client/app/src/main/AndroidManifest.xml, client/app/src/main/java/com/curse/rat/MainActivity.java, and client/app/src/main/java/com/curse/rat/MainService.java.

C2 Server and Dashboard

The Node.js server hosts the C2/control-plane functions and serves the THOR browser dashboard. Dashboard pages cover connected-client management, deployment/building, logs, and settings:

• server/server.js

• server/public/index.html

• server/public/UI/clients.html

• server/public/client.js

This is the main boundary between operators and enrolled Android clients. It manages listener/client state, relays commands, and exposes telemetry and operational status to the UI.

Payload Build Pipeline

The builder subsystem produces or patches Android payloads, including package/manifest/resource changes described by the README. It is separated from the live C2 server but likely invoked through the deployment dashboard.

• server/builder.js

• server/public/UI/build.html

• client/app/src/main/AndroidManifest.xml

Its external tool boundary is the local host environment: apktool, Java signing tools (jarsigner), and Android SDK zipalign. Generated APKs are intended for an output location, though that directory is not present in the supplied tree.

Android Runtime Persistence and Connectivity

The Android client combines an activity-facing entry point with a long-running service responsible for background operation and server connectivity.

• client/app/src/main/java/com/curse/rat/MainActivity.java

• client/app/src/main/java/com/curse/rat/MainService.java

• client/app/src/main/java/com/curse/rat/ConnectionManager.java

ConnectionManager is the client-side C2 transport boundary. MainService is the central runtime coordinator for receiving work and maintaining execution outside the visible activity, subject to Android foreground-service and permission constraints.

Command Dispatch and Capability Modules

Incoming C2 work is routed through a command-processing layer into focused device-capability managers:

• client/app/src/main/java/com/curse/rat/CommandProcessor.java

• client/app/src/main/java/com/curse/rat/FileManager.java

• client/app/src/main/java/com/curse/rat/DeviceInfoManager.java

Additional modules isolate sensitive collection or device-control domains: contacts/SMS/location, camera/microphone/screen capture, notifications, and keylogging. This modularity makes CommandProcessor the principal control-flow junction and confines Android API interactions to dedicated managers.

Media and Device Data Flows

The client gathers device state or media through managers, sends results over the connection layer, and presents received data/state through the server dashboard. Screen capture has a distinct activity, reflecting Android’s user-mediated capture APIs:

• client/app/src/main/java/com/curse/rat/CameraManager.java

• client/app/src/main/java/com/curse/rat/ScreenCastActivity.java

• client/app/src/main/java/com/curse/rat/LocManager.java

High-volume camera/screen streams are materially different from discrete command responses such as device information, files, messages, contacts, or location; the server/dashboard must therefore handle both live telemetry and result-oriented data.

Runtime and Platform Boundaries

Server runtime requirements are Node.js 16+ and npm; the Android project uses Gradle, Java 11, and the Android SDK:

• server/package.json

• client/app/build.gradle

• client/app/src/main/res/xml/accessibility_service_config.xml

Android permissions and service declarations in the manifest define the platform-security boundary for background execution, accessibility-related features, capture, sensors, storage, and communications. The browser dashboard is static frontend content served by the Node process rather than a separate web-service project.