PackClient

Reverse Engineering a Modular RAT Framework

   

Reconstruction of the launcher's 1RCP screenshot-worker protocol, transport, authentication, PLK1 delivery/cache behavior, active-session handoff, and runtime evidence tied to the recovered build.

Read the Publication  ·  Download the PDF

Findings

• Reconstruction of the worker-side 1RCP interface: a 20-byte header, four message types, top-down BGRX framebuffer data, and an external endpoint peer.
• Recovered transport and authentication contracts: outer framing, handshake, authenticated AES-CBC receive ordering, and the PLK1 cache acceptance path.
• Runtime correspondence between the reconstructed launcher and private mappings, persistence, and attempted connectivity in evidence sets.
• Three passive tool interfaces, a benign 1RCP peer/simulator kit, synthetic tests, and experimental detection candidates.

Recovered architecture

flowchart TD
    H["Signed NVDA Host<br/>Tax_Notice_23665.exe"]
    C["Carrier DLL<br/>nvdaHelperRemote.dll"]

    subgraph P[" "]
        A["Executable A<br/>Wrapper / Mapper"]
        B["Executable B<br/>PackClientLauncher.exe"]
        A -->|"maps embedded PE"| B
    end

    H -->|"DLL sideload"| C
    C -->|"transformed package<br/>XOR 0x70"| A

    B --> T["Transport + Authentication<br/>PLH1 / PLC1 / PLA1"]
    B --> K["PLK1 Delivery + Cache"]
    B --> S["Active-session Handoff"]
    B --> R["1RCP Screenshot Worker"]

    K -. "core-like PE contract" .-> CORE["PackClientCore<br/>Unrecovered"]
    R -. "pre-existing local endpoint" .-> PEER["External 1RCP Peer<br/>Unrecovered"]

Loading

References

Topic	Reference
Host, carrier, package and recovered components	Architecture
1RCP screenshot protocol and framebuffer	Screenshot IPC
Benign local peer/simulator	Synthetic IPC validation
Framing, handshake, encryption and PLK1	Protocol
Token selection and session drift	Active-session Handoff
Runtime memory, persistence and network observations	Runtime
Artifact identities and claim boundaries	Evidence
Research limitations	Limitations
Passive decoders	Tooling
Detection candidates	Detection Guide

Tools

Interface	Purpose
tools/packclient_decode.py	Decode supplied raw streams into structured JSON
tools/packclient_pcap_decode.py	Decode supplied PCAP/PCAPNG into per-flow timelines
tools/wireshark/packclient.lua	Display protocol metadata in Wireshark/TShark

The Python CLIs require Python 3.11–3.13 and the standard library. LZ4 support and detection-engine tests have separate pinned optional dependencies. The quickstart creates a deterministic synthetic input without any malware.

python -B -m unittest discover -s tests -v

The optional synthetic IPC kit exercises the reconstructed 1RCP contract using benign deterministic inputs and outputs, without malware or desktop capture.

Detection

The Sigma, Suricata and YARA rules are included as experimental detection candidates with regression coverage. Production accuracy has not been measured.

Scope and Limitations

The available evidence does not establish a recovered Core, the external 1RCP peer's identity, successful C2, a complete real 1RCP exchange, the exact upstream injection subtype, envelope-key initialization, or the causal diagnosis of the worker failure.

Additional reproducibility gaps are documented in Evidence and Limitations.

Prior Work

PackClient was previously documented by Proofpoint. This work focuses on implementation details of the recovered launcher build. See Prior Work for more details.

Citation

Use CITATION.cff to cite the report.

Research cut-off: 5 September 2026.

Publication date: 6 September 2026.