This repository documents the supplied password-protected 5mb8dr6.rar through static inspection. Analysis date: 2026-10-02. It includes the recovered source and resource files as text, with hashes and an explanation of the major components. No sample was run, built, installed, or allowed to contact network endpoints.

Malicious code is present. The text extensions are for inspection and do not sanitize the code.

Artifact and scope

Property	Value
Original filename	`5mb8dr6.rar`
Archive size	9,059,962 bytes
Archive SHA-256	`f88faa866eb385b4aec3f4fc8de98756922d458b59f80adfa557a50d705cd1c0`
Original root	`xanrat source/c2`
Inventory	589 files, 79 directories; 22,367,501 uncompressed bytes
C# files	519, of which 479 already contain decompiler banners
Other components	9 projects, 7 solutions, 17 DLLs, resources and configuration

The supplied password unlocked all 589 files. Each recovery completed without extractor integrity errors and matched the recorded uncompressed size. 572 source/resource/configuration files are published under code/ with .txt appended to their original names. Bundled DLLs are represented by their hashes and assembly metadata rather than executable downloads. A resource-embedded loader is additionally represented by static decompilation.

The package is largely reconstructed C#, not verified original developer source. Its embedded decompiler banners and filenames do not establish authorship. No successful build or working behavior on current software versions is claimed.

What the code implements

Component	Behavior established in the inspected code	Evidence
Client	Hidden command shell, file/process/registry operations, reverse proxy, and remotely supplied .NET plugin loading	Client code
Keylogger	Global keyboard events, foreground-window titles, and log buffering	Keylogger
Password recovery	Browser and FTP credential readers, with account results sent over the client connection	Password handler
Stealer	Chromium/Gecko browser data, application data, and wallet-related collection	Stealer handler, application dispatch
Hidden desktop	Separate Windows desktop creation, image capture, input, and process control	HVNC code
Webcam	Starts a selected capture device on request and transmits encoded frames	Webcam handler
Startup	Logon scheduled task or HKCU Run entry, depending on privileges/settings	Startup code
Recovery persistence attempt	Modifies Windows Recovery/OEM reset configuration to attempt execution after a reset	Survival code

The stealer's browser collection includes passwords, cookies, history, autofill, payment data, and extension data. Its application dispatch includes Discord, Telegram, Steam, OBS, Ngrok, WinSCP, FileZilla, FoxMail, and wallet-related data. These are implemented collection paths, not a claim that every path currently succeeds or that data was stolen during this analysis.

How the components fit together

InvokedServer control application
  ├─ client configuration/build components
  ├─ control and collection message handlers
  └─ plugins delivered to the connected client
          ↓
InvokedClient
  ├─ shared InvokedCommon messages and cryptography
  ├─ core shell / file / process / registry / proxy functions
  └─ runtime plugin loading
       ├─ desktop and hidden-desktop control
       ├─ webcam capture
       ├─ password and application-data collection
       └─ persistence-related functionality

The client's inspected settings template has empty host, version, encryption-key, and certificate fields. Installation, startup, and automatic-keylogging defaults are false. These template defaults do not remove the capabilities in the code. No fixed attacker server was established from this template.

Resource-embedded loader

Properties/Resources.resx contains a 10,752-byte managed PE named Stub. It was decoded as data and decompiled. Its code attempts to decrypt an embedded payload and perform process hollowing into regasm.exe. The recovered template retains key/compression placeholders and has no embedded payload resource of its own.

This is a compiled .NET loader, not the ::{marker}::{Base64 payload} batch-comment structure from the other sample. No ::JZ2qvj:: marker was found in the recovered text.

Stub SHA-256: aaef6bdcd007e3c1bbb1853e61ff48562dae7d3da5a6bf1bf8f88f9046105c86
Static stub decompilation
Embedded-resource metadata

Relationship to the other sample

The RAR/batch/InvokedClient report documents clarkkk#@..rar, atlasb.bat, and u.exe. Names and architecture in this source package support a related Invoked/Quasar codebase. Four unique third-party libraries match that sample byte-for-byte: MouseKeyHook, Newtonsoft.Json, protobuf-net, and DiagnosticSource. InvokedCommon.dll does not match byte-for-byte.

Shared third-party dependencies alone do not identify an author or prove which source produced an executable. The prior sample's configured server, encryption-key literal, and batch marker were absent from the recovered text. Exact build provenance remains unproven.

Evidence and limitations

Published source manifest: original archive path, publication path, byte length, and SHA-256.
Library comparison: hashes of the supplied DLLs and matches with the earlier archive.
Assembly metadata: identities, referenced assemblies, and resource names inspected without loading code for execution.

No archive traversal paths, link targets, or hidden STM stream records were observed; this differs from the previous RAR. That finding does not make the contents safe. This review covered archive structure, configuration, major handlers, build events, assembly metadata, and the embedded stub; it was not an exhaustive audit of every dependency.

Source and resource text is preserved for research; executable containers, deployment instructions, credential material for the publication server, and analyst-machine details are not included. No code was repaired or enhanced. No new license is asserted over third-party material.