# thorthehacker111/curse_rat architecture

> Architecture diagram of the GitHub repository thorthehacker111/curse_rat, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-08-03). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/thorthehacker111/curse_rat
- Repository: https://github.com/thorthehacker111/curse_rat

## Overview

#### Purpose and Entrypoints
CURSE RAT is an Android remote-administration/C2 system with a Node.js server, browser dashboard, APK builder, and Java Android client. The operational server entry point is `server/server.js`; APK modification/build orchestration is `server/builder.js`. The Android application begins through its manifest and UI/service lifecycle in `client/app/src/main/AndroidManifest.xml`, `client/app/src/main/java/com/curse/rat/MainActivity.java`, and `client/app/src/main/java/com/curse/rat/MainService.java`.

#### C2 Server and Dashboard
The Node.js server hosts the C2/control-plane functions and serves the THOR browser dashboard. Dashboard pages cover connected-client management, deployment/building, logs, and settings:
- `server/server.js`
- `server/public/index.html`
- `server/public/UI/clients.html`
- `server/public/client.js`

This is the main boundary between operators and enrolled Android clients. It manages listener/client state, relays commands, and exposes telemetry and operational status to the UI.

#### Payload Build Pipeline
The builder subsystem produces or patches Android payloads, including package/manifest/resource changes described by the README. It is separated from the live C2 server but likely invoked through the deployment dashboard.
- `server/builder.js`
- `server/public/UI/build.html`
- `client/app/src/main/AndroidManifest.xml`

Its external tool boundary is the local host environment: `apktool`, Java signing tools (`jarsigner`), and Android SDK `zipalign`. Generated APKs are intended for an `output` location, though that directory is not present in the supplied tree.

#### Android Runtime Persistence and Connectivity
The Android client combines an activity-facing entry point with a long-running service responsible for background operation and server connectivity.
- `client/app/src/main/java/com/curse/rat/MainActivity.java`
- `client/app/src/main/java/com/curse/rat/MainService.java`
- `client/app/src/main/java/com/curse/rat/ConnectionManager.java`

`ConnectionManager` is the client-side C2 transport boundary. `MainService` is the central runtime coordinator for receiving work and maintaining execution outside the visible activity, subject to Android foreground-service and permission constraints.

#### Command Dispatch and Capability Modules
Incoming C2 work is routed through a command-processing layer into focused device-capability managers:
- `client/app/src/main/java/com/curse/rat/CommandProcessor.java`
- `client/app/src/main/java/com/curse/rat/FileManager.java`
- `client/app/src/main/java/com/curse/rat/DeviceInfoManager.java`

Additional modules isolate sensitive collection or device-control domains: contacts/SMS/location, camera/microphone/screen capture, notifications, and keylogging. This modularity makes `CommandProcessor` the principal control-flow junction and confines Android API interactions to dedicated managers.

#### Media and Device Data Flows
The client gathers device state or media through managers, sends results over the connection layer, and presents received data/state through the server dashboard. Screen capture has a distinct activity, reflecting Android’s user-mediated capture APIs:
- `client/app/src/main/java/com/curse/rat/CameraManager.java`
- `client/app/src/main/java/com/curse/rat/ScreenCastActivity.java`
- `client/app/src/main/java/com/curse/rat/LocManager.java`

High-volume camera/screen streams are materially different from discrete command responses such as device information, files, messages, contacts, or location; the server/dashboard must therefore handle both live telemetry and result-oriented data.

#### Runtime and Platform Boundaries
Server runtime requirements are Node.js 16+ and npm; the Android project uses Gradle, Java 11, and the Android SDK:
- `server/package.json`
- `client/app/build.gradle`
- `client/app/src/main/res/xml/accessibility_service_config.xml`

Android permissions and service declarations in the manifest define the platform-security boundary for background execution, accessibility-related features, capture, sensors, storage, and communications. The browser dashboard is static frontend content served by the Node process rather than a separate web-service project.

Main entry points: [`client/app/src/main/java/com/curse/rat/ConnectionManager.java`](https://github.com/thorthehacker111/curse_rat/blob/main/client/app/src/main/java/com/curse/rat/ConnectionManager.java) (C2 transport), [`client/app/src/main/java/com/curse/rat/CommandProcessor.java`](https://github.com/thorthehacker111/curse_rat/blob/main/client/app/src/main/java/com/curse/rat/CommandProcessor.java) (Command dispatcher), [`server/public/index.html`](https://github.com/thorthehacker111/curse_rat/blob/main/server/public/index.html) (THOR dashboard), [`client/app/src/main/AndroidManifest.xml`](https://github.com/thorthehacker111/curse_rat/blob/main/client/app/src/main/AndroidManifest.xml) (App manifest)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_operator["Operator UI"]
  node_browser(("Operator browser<br/>user agent"))
  node_dashboard["THOR dashboard<br/>static frontend<br/>[index.html]"]
  node_clients_ui["Client management<br/>dashboard page<br/>[clients.html]"]
  node_build_ui["Deployment builder UI<br/>dashboard page<br/>[build.html]"]
  node_dashboard_client["Dashboard client logic<br/>browser JavaScript<br/>[client.js]"]
end

subgraph group_server["Node.js C2"]
  node_c2_server{{"C2 server<br/>Node.js entrypoint<br/>[server.js]"}}
  node_builder["APK builder<br/>build orchestrator<br/>[builder.js]"]
end

subgraph group_android["Android Client"]
  node_manifest["App manifest<br/>Android declarations"]
  node_main_activity["Main activity<br/>Android UI entrypoint<br/>[MainActivity.java]"]
  node_main_service{{"Main service<br/>background coordinator<br/>[MainService.java]"}}
  node_connection["C2 transport<br/>connection manager"]
  node_commands{{"Command dispatcher<br/>command processor"}}
  node_file_manager["File operations<br/>capability manager<br/>[FileManager.java]"]
  node_device_info["Device information<br/>capability manager"]
  node_camera["Camera capture<br/>media manager<br/>[CameraManager.java]"]
  node_screencast["Screen capture consent<br/>Android activity"]
  node_location["Location collection<br/>capability manager<br/>[LocManager.java]"]
end

subgraph group_platform["Build &amp; Platform"]
  node_host_tools["APK/signing tools<br/>host toolchain"]
  node_server_deps["Server runtime<br/>Node.js/npm<br/>[package.json]"]
  node_android_build["Android build<br/>Gradle project<br/>[build.gradle]"]
  node_accessibility_config["Accessibility config<br/>Android platform config"]
end

node_browser -->|"loads"| node_dashboard
node_dashboard -->|"navigates to"| node_clients_ui
node_dashboard -->|"navigates to"| node_build_ui
node_dashboard -->|"runs"| node_dashboard_client
node_dashboard_client -->|"control and status requests"| node_c2_server
node_c2_server -->|"serves"| node_dashboard
node_build_ui -->|"requests payload build"| node_builder
node_builder -->|"invokes"| node_host_tools
node_builder -.->|"patches package metadata"| node_manifest
node_server_deps -.->|"runs"| node_c2_server
node_android_build -->|"packages"| node_manifest
node_manifest -->|"launches"| node_main_activity
node_manifest -->|"declares"| node_main_service
node_manifest -.->|"references"| node_accessibility_config
node_main_activity -->|"starts"| node_main_service
node_main_service -->|"maintains connectivity"| node_connection
node_connection -->|"C2 commands and telemetry"| node_c2_server
node_connection -->|"delivers commands"| node_commands
node_commands -->|"dispatches"| node_file_manager
node_commands -->|"dispatches"| node_device_info
node_commands -->|"dispatches"| node_camera
node_commands -->|"dispatches"| node_screencast
node_commands -->|"dispatches"| node_location
node_file_manager -->|"returns results"| node_connection
node_device_info -->|"returns telemetry"| node_connection
node_camera -->|"streams media"| node_connection
node_screencast -->|"streams capture"| node_connection
node_location -->|"returns location"| node_connection

click node_dashboard "https://github.com/thorthehacker111/curse_rat/blob/main/server/public/index.html"
click node_clients_ui "https://github.com/thorthehacker111/curse_rat/blob/main/server/public/UI/clients.html"
click node_build_ui "https://github.com/thorthehacker111/curse_rat/blob/main/server/public/UI/build.html"
click node_dashboard_client "https://github.com/thorthehacker111/curse_rat/blob/main/server/public/client.js"
click node_c2_server "https://github.com/thorthehacker111/curse_rat/blob/main/server/server.js"
click node_builder "https://github.com/thorthehacker111/curse_rat/blob/main/server/builder.js"
click node_server_deps "https://github.com/thorthehacker111/curse_rat/blob/main/server/package.json"
click node_android_build "https://github.com/thorthehacker111/curse_rat/blob/main/client/app/build.gradle"
click node_manifest "https://github.com/thorthehacker111/curse_rat/blob/main/client/app/src/main/AndroidManifest.xml"
click node_main_activity "https://github.com/thorthehacker111/curse_rat/blob/main/client/app/src/main/java/com/curse/rat/MainActivity.java"
click node_main_service "https://github.com/thorthehacker111/curse_rat/blob/main/client/app/src/main/java/com/curse/rat/MainService.java"
click node_connection "https://github.com/thorthehacker111/curse_rat/blob/main/client/app/src/main/java/com/curse/rat/ConnectionManager.java"
click node_commands "https://github.com/thorthehacker111/curse_rat/blob/main/client/app/src/main/java/com/curse/rat/CommandProcessor.java"
click node_file_manager "https://github.com/thorthehacker111/curse_rat/blob/main/client/app/src/main/java/com/curse/rat/FileManager.java"
click node_device_info "https://github.com/thorthehacker111/curse_rat/blob/main/client/app/src/main/java/com/curse/rat/DeviceInfoManager.java"
click node_camera "https://github.com/thorthehacker111/curse_rat/blob/main/client/app/src/main/java/com/curse/rat/CameraManager.java"
click node_screencast "https://github.com/thorthehacker111/curse_rat/blob/main/client/app/src/main/java/com/curse/rat/ScreenCastActivity.java"
click node_location "https://github.com/thorthehacker111/curse_rat/blob/main/client/app/src/main/java/com/curse/rat/LocManager.java"
click node_accessibility_config "https://github.com/thorthehacker111/curse_rat/blob/main/client/app/src/main/res/xml/accessibility_service_config.xml"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_browser,node_dashboard,node_clients_ui,node_build_ui,node_dashboard_client toneBlue
class node_c2_server,node_builder toneAmber
class node_manifest,node_main_activity,node_main_service,node_connection,node_commands,node_file_manager,node_device_info,node_camera,node_screencast,node_location toneMint
class node_host_tools,node_server_deps,node_android_build,node_accessibility_config toneRose
```

## Components

### Operator UI

- **Operator browser**: user agent
- [THOR dashboard](https://github.com/thorthehacker111/curse_rat/blob/main/server/public/index.html): static frontend · Served by the Node.js process. · `server/public/index.html`
- [Client management](https://github.com/thorthehacker111/curse_rat/blob/main/server/public/UI/clients.html): dashboard page · `server/public/UI/clients.html`
- [Deployment builder UI](https://github.com/thorthehacker111/curse_rat/blob/main/server/public/UI/build.html): dashboard page · `server/public/UI/build.html`
- [Dashboard client logic](https://github.com/thorthehacker111/curse_rat/blob/main/server/public/client.js): browser JavaScript · `server/public/client.js`

### Node.js C2

- [C2 server](https://github.com/thorthehacker111/curse_rat/blob/main/server/server.js): Node.js entrypoint · Maintains client state, relays commands, and serves telemetry. · `server/server.js`
- [APK builder](https://github.com/thorthehacker111/curse_rat/blob/main/server/builder.js): build orchestrator · Patches and packages Android payloads. · `server/builder.js`

### Android Client

- [App manifest](https://github.com/thorthehacker111/curse_rat/blob/main/client/app/src/main/AndroidManifest.xml): Android declarations · Defines permissions, services, and application entry configuration. · `client/app/src/main/AndroidManifest.xml`
- [Main activity](https://github.com/thorthehacker111/curse_rat/blob/main/client/app/src/main/java/com/curse/rat/MainActivity.java): Android UI entrypoint · `client/app/src/main/java/com/curse/rat/MainActivity.java`
- [Main service](https://github.com/thorthehacker111/curse_rat/blob/main/client/app/src/main/java/com/curse/rat/MainService.java): background coordinator · Maintains operation and executes work beyond the visible activity. · `client/app/src/main/java/com/curse/rat/MainService.java`
- [C2 transport](https://github.com/thorthehacker111/curse_rat/blob/main/client/app/src/main/java/com/curse/rat/ConnectionManager.java): connection manager · Client-side transport boundary to the server. · `client/app/src/main/java/com/curse/rat/ConnectionManager.java`
- [Command dispatcher](https://github.com/thorthehacker111/curse_rat/blob/main/client/app/src/main/java/com/curse/rat/CommandProcessor.java): command processor · Routes incoming C2 work to capability modules. · `client/app/src/main/java/com/curse/rat/CommandProcessor.java`
- [File operations](https://github.com/thorthehacker111/curse_rat/blob/main/client/app/src/main/java/com/curse/rat/FileManager.java): capability manager · `client/app/src/main/java/com/curse/rat/FileManager.java`
- [Device information](https://github.com/thorthehacker111/curse_rat/blob/main/client/app/src/main/java/com/curse/rat/DeviceInfoManager.java): capability manager · `client/app/src/main/java/com/curse/rat/DeviceInfoManager.java`
- [Camera capture](https://github.com/thorthehacker111/curse_rat/blob/main/client/app/src/main/java/com/curse/rat/CameraManager.java): media manager · Produces high-volume media telemetry. · `client/app/src/main/java/com/curse/rat/CameraManager.java`
- [Screen capture consent](https://github.com/thorthehacker111/curse_rat/blob/main/client/app/src/main/java/com/curse/rat/ScreenCastActivity.java): Android activity · Handles user-mediated screen capture APIs. · `client/app/src/main/java/com/curse/rat/ScreenCastActivity.java`
- [Location collection](https://github.com/thorthehacker111/curse_rat/blob/main/client/app/src/main/java/com/curse/rat/LocManager.java): capability manager · `client/app/src/main/java/com/curse/rat/LocManager.java`

### Build & Platform

- **APK/signing tools**: host toolchain · apktool, jarsigner, and zipalign execute outside Node.js.
- [Server runtime](https://github.com/thorthehacker111/curse_rat/blob/main/server/package.json): Node.js/npm · `server/package.json`
- [Android build](https://github.com/thorthehacker111/curse_rat/blob/main/client/app/build.gradle): Gradle project · Builds with Java 11 and the Android SDK. · `client/app/build.gradle`
- [Accessibility config](https://github.com/thorthehacker111/curse_rat/blob/main/client/app/src/main/res/xml/accessibility_service_config.xml): Android platform config · Declares accessibility-service behavior. · `client/app/src/main/res/xml/accessibility_service_config.xml`

## Connections

- Operator browser → THOR dashboard: loads
- THOR dashboard → Client management: navigates to
- THOR dashboard → Deployment builder UI: navigates to
- THOR dashboard → Dashboard client logic: runs
- Dashboard client logic → C2 server: control and status requests
- C2 server → THOR dashboard: serves
- Deployment builder UI → APK builder: requests payload build
- APK builder → APK/signing tools: invokes
- APK builder → App manifest: patches package metadata
- Server runtime → C2 server: runs
- Android build → App manifest: packages
- App manifest → Main activity: launches
- App manifest → Main service: declares
- App manifest → Accessibility config: references
- Main activity → Main service: starts
- Main service → C2 transport: maintains connectivity
- C2 transport → C2 server: C2 commands and telemetry · Carries both discrete results and live media streams.
- C2 transport → Command dispatcher: delivers commands
- Command dispatcher → File operations: dispatches
- Command dispatcher → Device information: dispatches
- Command dispatcher → Camera capture: dispatches
- Command dispatcher → Screen capture consent: dispatches
- Command dispatcher → Location collection: dispatches
- File operations → C2 transport: returns results
- Device information → C2 transport: returns telemetry
- Camera capture → C2 transport: streams media
- Screen capture consent → C2 transport: streams capture
- Location collection → C2 transport: returns location