C2 Framework & Stealer Source Code for Sell (MaaS)

[desperados_1337]

Hello DNA;

A C2 + Stealer Framework with following features is for sell, this framework is designed with a MaaS (malware as a service) business model in mind and is ready to use for such services:


Teamserver

• headless C2 server written in Python with full database and event logging support; sessions, tasks, users, listeners, autorun rules, builds and audit events are all DB-backed
• Framework log / activity management with unified timelines covering commands, task results, session lifecycle events and system events; exportable logs with tags and filterable history
• World map for monitoring infections and sessions with geo lookup/caching and refreshable session geolocation
• Frontend developed in pure HTML/CSS + JS web panel (no React/Vue/Angular or other frameworks at all); separate admin and operator shells; code security is checked and verified
• Multi-user RBAC with policy-based access control: admins, operators and user expiration dates
• Users are isolated by ownership, session visibility quotas, access policies and work environment (operators see only what policy allows; sensitive implant/listener fields can be hidden)
• Supports user authentication control, failed-login handling and account lockout / block policies
• In-app real-time chatting system
• Download manager for credentials, files, folders, screenshots and stealer artifacts with per-agent storage layout
• Implant generation window (Windows/Linux, x86/x64, protocol/listener binding, sleep/jitter, dead-drop options, optional PE packer)
• User dashboard, stealer log management window, stealer builder window, agent/session management, listeners, activity logs
• Multi-threaded server; concurrent listeners, sessions, task queues, builds and panel traffic without blocking the core functionalities
• Supports 6 C2 protocols: mTLS, HTTP (encrypted), DNS, NTP, ICMP, raw TCP (encrypted persistent session — push tasking, no classic beacon sleep model)
• All C2 comms encrypted; per-listener keys; server-side verification paths to reject bad/simulated traffic
• Nonce verification (implant ↔ owner/build binding style checks) and anti-replay style protections for beaconing and real-time TCP sessions
• Task queues with partial/final results; time-based and automated agent tasking via autorun (initial / periodic / timebomb), including scoped rules and per-session overrides
• Command broadcasting across multiple owned sessions (policy-gated “botnet-style” fan-out)
• Listener sharing between users and redirector configuration
• Session console: interactive command line, tab completion, OS-aware help, context menus
• Embedded session file browser UI (list/navigate/download/delete/mkdir/cat) and process manager UI (list/kill)
• Live TCP push wake-on-task so interactive sessions get work immediately; poll protocols deliver on next check-in
• Build queues / quotas for implants and stealer
• Geo cache, session metadata (OS/arch/user/host/IP/PID/privilege/protocol), aliasing and ownership tracking

Implants (Linux & Windows)

• cross-platform features:
  • Both Linux and Windows implants in pure C; x64 and x86 targets
  • Both are PIC-oriented / API-resolved style and packer-friendly (designed to survive packing and manual-map style loaders)
  • All 6 C2 protocols available in both implants with the same tasking surface for shared commands
  • Dead-drop fallback when configured C2 list is empty or all callbacks fail; multiple callback addresses; runtime switch / transports to add, list, delete and change protocols/listeners without rebuilding
  • Beacon model on HTTP/mTLS/DNS/ICMP/NTP with sleep + jitter; TCP maintains an encrypted length-prefixed persistent channel with server push
  • Filesystem: ls, cd, pwd, cat, rm, cp, mv, mkdir
  • Transfers: upload, download (chunk sizes adapt to protocol — tiny on DNS/NTP/ICMP, large on HTTP/mTLS/TCP)
  • list and kill running processes
  • show detailed system information (hardware, installed apps, OS info, etc.)
  • Dynamic sleep and jitter configuration
  • self-deletion (removing implant file from disk at run-time)
  • Can run applications on target host with given commandline parameters (fire & forget)
  • Clipboard dumper + dump parse and deduplication
  • Smart keylogger with advanced window tracking and log merging / deduplication (logs auto-parsed and shown based on app and window title)
  • Execute system shell commands (cmd, bash)
  • Shellcode execution in-memory + evasion & PPID spoofing
  • OPSEC compile/runtime options: advanced DLL unhooking beyond NTDLL, ETW bypass, anti-emulation, smart anti-debugging and anti-VM checks, self-delete/erase, optional kill date (tested against multiple top-tier EDR products)
  • Failover across C2 entries with retry/backoff behavior per protocol class
• Windows-specific post-exploitation:
  • screenshot
  • webcam snapshot
  • runpe — in-memory PE loader with command-line argument support
  • rundll — reflective/in-process DLL execution with command-line argument support
  • dotnet — in-memory .NET assembly execution with command-line argument support
  • stealer — full Windows stealer plugin run + download and parse output (no disk writes at all)
• Linux-specific post-exploitation:
  • runelf — in-memory ELF execution

Implant Packer/Crypter

• First-class PE/ELF packer integrated into the C2 implant generator pipeline, implants are automatically packed after build
• compress + encrypt + payload scattering, anti-VM / anti-debugger
• custom source code obfuscation and mutation engine + custom LLVM passes + entropy reduction
• zero strings or IOCs, polymorphic output binary with 70% diff between each build
• supports command-line password for max payload protection
• supports x86 and x64 implants for both OS families
• Packer/crypter can be also used as a separate tool for

Stealer

• Separate buildable stealer plugin with server-side parse + enrichment + panel log UI
• Dual collection strategy: direct file/DB extraction and ABE bypass for latest chrome-based browsers
• Browsers: large Chromium set + Firefox family — passwords, cookies, cards/CVC/IBAN, autofill, bookmarks, history, extensions/wallet extensions
• Key recovery: DPAPI / ABE elevation service paths; Firefox NSS decrypt
• 30+ desktop crypto wallets (file harvest), messaging (Discord/Telegram/Signal/Element/Pidgin), system creds (Credential Manager, RDP, Wi-Fi), mail/FTP/VPN/gaming configs, password-manager vault files (KeePass/Bitwarden/LastPass/1Password artifacts)
• Dumps uploaded into per-agent stealer trees; panel supports structured viewing, merge/enrichment
• logs are integrated with smart keylogger and clipboard dumper + enriched view (keystrokes shown per-application and per-window)
• File grabber functionality with custom rules and file extention support (works with for file name keywords, extention, size and max number of files to grab)

Panel surfaces

• Dashboard — overview of users/sessions/health style ops view
• World Map — geo-mapped sessions/infections
• Sessions — agent list, console splitter, OS icons/short names, context actions, broadcast entry points
• Listeners — create/manage protocols, keys, sharing, redirectors
• Generator — implant build form + packer options + dead-drop / transport binding
• Stealer Builder — personal/platform stealer builds
• Chat — operator↔admin messaging
• Activity Logs — timeline / audit / export oriented event view
• Downloads — files, folders, captures, credentials artifacts
• Stealer — dump browser/log management UI

Automation & scale

• Autorun rules: initial (first connect), periodic, timebomb; groupable; scopable to all agents / filters / explicit session IDs; per-session overrides; execution tracking in DB
• Broadcast commands to many sessions under policy (botnet capabilities)
• Concurrent tasking across agents; TCP push for low-latency ops; poll agents continue reliable check-in under sleep/jitter
• Multi-listener, multi-protocol, multi-user concurrent operation on one teamserver instance

price: $10,000


one time sell only + initial setup and usage support
Escrow only



Verified buyers and DNA admins (ONLY) can have a live demo of the platform and web panel.

for more info, DM me or contact on:



session:
054ed5c279e4d25add442a8dbe8092c2b7649370f3e61f32234cf78de051449b1e