RAR → batch → PowerShell → InvokedClient: static analysis

This report documents a Windows malware chain recovered from clarkkk#@..rar, and its relationship to the separately supplied atlasb.bat and u.exe. Analysis date: 2026-10-02. The supplied files were inspected as data; no sample was executed, built, or allowed to contact its configured servers.

Malicious code is present in the text files. Read it as evidence; do not execute it.

What was established

atlasb.bat is byte-for-byte identical to the batch payload recovered from the RAR. u.exe is byte-for-byte identical to the final .NET executable decoded from that batch chain. These connections were verified by SHA-256, not inferred from filenames.

Supplied artifact	Size in bytes	SHA-256
clarkkk#@..rar	2,446,532	9a5f4cb7d903b736558551e7c777cea872bb91c9eb00e580ec23cd35114c630e
atlasb.bat / recovered batch	1,187,656	01d0adb3c1d4d5b689e4181dc74f49f966b0ba4564e798e00893b051016b7e2a
u.exe / decoded .NET payload	648,704	67c65434d8de53b7976be1e0ab9d38cfff45642e5fc64a5b49c600f283c4bac3

How the components connect

RAR5 archive
  ├─ visible personal-information decoy — omitted from this publication
  ├─ hidden batch streams → atlasb.bat
  │    └─ comment-embedded PowerShell
  │         └─ Donut loader → .NET InvokedClient payload → u.exe
  └─ hidden VBScript downloader — separate route; launch not established

The archive has five hidden NTFS alternate-stream records containing two unique scripts. Some stream names use parent-directory traversal targeting a Windows Startup directory. This is consistent with the WinRAR technique described in ESET's CVE-2025-8088 research; exploitation was not tested. Recovery discarded those paths and used fixed output filenames.

The batch copies itself to %APPDATA%\GoogleChrome\update.bat and establishes an HKCU Run value named GoogleChromeUpdate. It reads its own file and finds a comment-style marker at line 263:

::JZ2qvj::{Base64-encoded PowerShell payload}

This is near the end, not the final line. The batch contains 288 lines. The recovered PowerShell selects an explorer process and uses a native API helper to map a section and start a remote thread. Static decoding recovered a Donut loader and its compressed managed payload.

The final payload uses InvokedClient and InvokedCommon components. It implements remote command execution, file/process/registry management, reverse proxy functions, and server-delivered .NET plugin loading. Keyboard logging and screen/input routines are present. The decoded sample configuration disables automatic keylogging; capabilities should not be confused with observed execution.

Code and provenance

Evidence	Location
Complete recovered batch, also matching atlasb.bat	Batch text
Separate recovered downloader	VBScript text
Decoded embedded PowerShell	PowerShell text
Decompiled final payload, matching u.exe	InvokedClient
Decompiled shared library and native API helper	Managed components
Decompiled embedded dependencies	Dependencies
Native loader's linear disassembly	Disassembly
Sizes and SHA-256 of published code files	Source manifest

The scripts were recovered directly. C# decompilation and native disassembly are reconstructed representations, not original developer source. Obfuscated names and decompiler warnings remain. The native disassembly can include data interpreted as instructions. No malware functionality was repaired or enhanced for this publication.

Original executable/archival containers are identified by hash rather than included as runnable downloads. The private decoy content and information about the analyst's computer are omitted.

Detection and investigation indicators

These indicators describe this sample; their presence or absence alone is not a verdict on a host.

Indicator	Observed value
Configured server	158.94.211[.]49:4782
Batch persistence file	%APPDATA%\GoogleChrome\update.bat
Run value	HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run → GoogleChromeUpdate
PowerShell mutex	tcyWDT
Client mutex	0b81aaf2-372f-4d7c-a58b-e27a5a5a8bcd
Client startup label	Quasar Client Startup
Downloader URL, defanged	hxxps://raw[.]githubusercontent[.]com/Koap9238/Google-Chrome/refs/heads/main/google.txt
Downloader temporary directory	%TEMP%\scoped_dir2716372_129425779512

The downloader URL was not fetched. The ten encrypted configuration fields passed HMAC verification during static decoding. No claim is made about the current activity or ownership of the configured endpoint.

Related source package and limits

See the analysis of 5mb8dr6.rar for a largely decompiled source package using the same Invoked/Quasar naming and architecture. Four third-party library hashes overlap. This does not prove that exact source package produced this executable or establish common authorship.

This is static evidence, not a recorded infection or sandbox trace. Additional server-delivered plugins and remotely fetched content were not present in this archive. The original source, author identity, and distribution history were not established. Copyright and license claims for third-party code are not changed by this research publication.

Supporting format references: RAR specification, Donut developer notes.