desperados_1337
Member
- Joined
- May 19, 2025
- Messages
- 6
- Reaction score
- 1
- Points
- 3
- Thread Author
- #1
Hello DNA;
A C2 + Stealer Framework with following features is for sell, this framework is designed with a MaaS (malware as a service) business model in mind and is ready to use for such services:
Teamserver
Implants (Linux & Windows)
Implant Packer/Crypter
Stealer
Panel surfaces
Automation & scale
price: $10,000
one time sell only + initial setup and usage support
Escrow only
Verified buyers and DNA admins (ONLY) can have a live demo of the platform and web panel.
for more info, DM me or contact on:
session:
054ed5c279e4d25add442a8dbe8092c2b7649370f3e61f32234cf78de051449b1e
A C2 + Stealer Framework with following features is for sell, this framework is designed with a MaaS (malware as a service) business model in mind and is ready to use for such services:
Teamserver
- headless C2 server written in Python with full database and event logging support; sessions, tasks, users, listeners, autorun rules, builds and audit events are all DB-backed
- Framework log / activity management with unified timelines covering commands, task results, session lifecycle events and system events; exportable logs with tags and filterable history
- World map for monitoring infections and sessions with geo lookup/caching and refreshable session geolocation
- Frontend developed in pure HTML/CSS + JS web panel (no React/Vue/Angular or other frameworks at all); separate admin and operator shells; code security is checked and verified
- Multi-user RBAC with policy-based access control: admins, operators and user expiration dates
- Users are isolated by ownership, session visibility quotas, access policies and work environment (operators see only what policy allows; sensitive implant/listener fields can be hidden)
- Supports user authentication control, failed-login handling and account lockout / block policies
- In-app real-time chatting system
- Download manager for credentials, files, folders, screenshots and stealer artifacts with per-agent storage layout
- Implant generation window (Windows/Linux, x86/x64, protocol/listener binding, sleep/jitter, dead-drop options, optional PE packer)
- User dashboard, stealer log management window, stealer builder window, agent/session management, listeners, activity logs
- Multi-threaded server; concurrent listeners, sessions, task queues, builds and panel traffic without blocking the core functionalities
- Supports 6 C2 protocols: mTLS, HTTP (encrypted), DNS, NTP, ICMP, raw TCP (encrypted persistent session — push tasking, no classic beacon sleep model)
- All C2 comms encrypted; per-listener keys; server-side verification paths to reject bad/simulated traffic
- Nonce verification (implant ↔ owner/build binding style checks) and anti-replay style protections for beaconing and real-time TCP sessions
- Task queues with partial/final results; time-based and automated agent tasking via autorun (initial / periodic / timebomb), including scoped rules and per-session overrides
- Command broadcasting across multiple owned sessions (policy-gated “botnet-style” fan-out)
- Listener sharing between users and redirector configuration
- Session console: interactive command line, tab completion, OS-aware help, context menus
- Embedded session file browser UI (list/navigate/download/delete/mkdir/cat) and process manager UI (list/kill)
- Live TCP push wake-on-task so interactive sessions get work immediately; poll protocols deliver on next check-in
- Build queues / quotas for implants and stealer
- Geo cache, session metadata (OS/arch/user/host/IP/PID/privilege/protocol), aliasing and ownership tracking
Implants (Linux & Windows)
- cross-platform features:
- Both Linux and Windows implants in pure C; x64 and x86 targets
- Both are PIC-oriented / API-resolved style and packer-friendly (designed to survive packing and manual-map style loaders)
- All 6 C2 protocols available in both implants with the same tasking surface for shared commands
- Dead-drop fallback when configured C2 list is empty or all callbacks fail; multiple callback addresses; runtime switch / transports to add, list, delete and change protocols/listeners without rebuilding
- Beacon model on HTTP/mTLS/DNS/ICMP/NTP with sleep + jitter; TCP maintains an encrypted length-prefixed persistent channel with server push
- Filesystem: ls, cd, pwd, cat, rm, cp, mv, mkdir
- Transfers: upload, download (chunk sizes adapt to protocol — tiny on DNS/NTP/ICMP, large on HTTP/mTLS/TCP)
- list and kill running processes
- show detailed system information (hardware, installed apps, OS info, etc.)
- Dynamic sleep and jitter configuration
- self-deletion (removing implant file from disk at run-time)
- Can run applications on target host with given commandline parameters (fire & forget)
- Clipboard dumper + dump parse and deduplication
- Smart keylogger with advanced window tracking and log merging / deduplication (logs auto-parsed and shown based on app and window title)
- Execute system shell commands (cmd, bash)
- Shellcode execution in-memory + evasion & PPID spoofing
- OPSEC compile/runtime options: advanced DLL unhooking beyond NTDLL, ETW bypass, anti-emulation, smart anti-debugging and anti-VM checks, self-delete/erase, optional kill date (tested against multiple top-tier EDR products)
- Failover across C2 entries with retry/backoff behavior per protocol class
- Windows-specific post-exploitation:
- screenshot
- webcam snapshot
- runpe — in-memory PE loader with command-line argument support
- rundll — reflective/in-process DLL execution with command-line argument support
- dotnet — in-memory .NET assembly execution with command-line argument support
- stealer — full Windows stealer plugin run + download and parse output (no disk writes at all)
- Linux-specific post-exploitation:
- runelf — in-memory ELF execution
Implant Packer/Crypter
- First-class PE/ELF packer integrated into the C2 implant generator pipeline, implants are automatically packed after build
- compress + encrypt + payload scattering, anti-VM / anti-debugger
- custom source code obfuscation and mutation engine + custom LLVM passes + entropy reduction
- zero strings or IOCs, polymorphic output binary with 70% diff between each build
- supports command-line password for max payload protection
- supports x86 and x64 implants for both OS families
- Packer/crypter can be also used as a separate tool for
Stealer
- Separate buildable stealer plugin with server-side parse + enrichment + panel log UI
- Dual collection strategy: direct file/DB extraction and ABE bypass for latest chrome-based browsers
- Browsers: large Chromium set + Firefox family — passwords, cookies, cards/CVC/IBAN, autofill, bookmarks, history, extensions/wallet extensions
- Key recovery: DPAPI / ABE elevation service paths; Firefox NSS decrypt
- 30+ desktop crypto wallets (file harvest), messaging (Discord/Telegram/Signal/Element/Pidgin), system creds (Credential Manager, RDP, Wi-Fi), mail/FTP/VPN/gaming configs, password-manager vault files (KeePass/Bitwarden/LastPass/1Password artifacts)
- Dumps uploaded into per-agent stealer trees; panel supports structured viewing, merge/enrichment
- logs are integrated with smart keylogger and clipboard dumper + enriched view (keystrokes shown per-application and per-window)
- File grabber functionality with custom rules and file extention support (works with for file name keywords, extention, size and max number of files to grab)
Panel surfaces
- Dashboard — overview of users/sessions/health style ops view
- World Map — geo-mapped sessions/infections
- Sessions — agent list, console splitter, OS icons/short names, context actions, broadcast entry points
- Listeners — create/manage protocols, keys, sharing, redirectors
- Generator — implant build form + packer options + dead-drop / transport binding
- Stealer Builder — personal/platform stealer builds
- Chat — operator↔admin messaging
- Activity Logs — timeline / audit / export oriented event view
- Downloads — files, folders, captures, credentials artifacts
- Stealer — dump browser/log management UI
Automation & scale
- Autorun rules: initial (first connect), periodic, timebomb; groupable; scopable to all agents / filters / explicit session IDs; per-session overrides; execution tracking in DB
- Broadcast commands to many sessions under policy (botnet capabilities)
- Concurrent tasking across agents; TCP push for low-latency ops; poll agents continue reliable check-in under sleep/jitter
- Multi-listener, multi-protocol, multi-user concurrent operation on one teamserver instance
price: $10,000
one time sell only + initial setup and usage support
Escrow only
Verified buyers and DNA admins (ONLY) can have a live demo of the platform and web panel.
for more info, DM me or contact on:
session:
054ed5c279e4d25add442a8dbe8092c2b7649370f3e61f32234cf78de051449b1e
Last edited: