Mar 06, 2025, 09:03 AM
TLDR
It is a free (for personal use) and highly customizable and documented, persistent FUD RAT targetting 64-bit Windows, including but not limited to:
Stealers, ransomware and a module allowing users to send custom messages and file attachments (including payloads) from infected users' accounts to all Discord friends, servers and server members.
Proof
For a showcase of some core features, see here:
Stealer
It includes stealer capabilities that can retrieve:
Spreading over Discord
It also lets users specify messages and files that will be sent from all infected host's Discord accounts to all:
Persistence
The payloads leverage a Windows vulnerability to gain persistent, SYSTEM-level (injected into an already-existing svchost process) access (on machine startup, not user-login).
This also means that, once a machine is infected, you have access to all users' files.
Ransomware
It also comes with ransomware functionality allowing you to drop and set custom ransom notes and wallpapers upon remotely encrypting drives/folders.
After sending the ransomware command, the used AES-256 encryption key is returned to the server, which can later be used to `deransom` the affected machine.
Discord/FTP exfiltration
Data can be stolen and retrieved to an active server, but users can also specify Discord webhooks or FTP servers to exfiltrate the stolen data to.
(self-hosted) Serverless configurations
The builder is higly customizable and allows you to embed commands that will be run upon payload execution.
This can be combined with the aforementioned Discord exfiltration to create payloads that do not depend on any self-hosted server.
Advanced features
It also features many commands fit for advanced users such as:
Tools
The provided tools include:
For a detailed guide on using the provided tools, as well as documentation specifying the use of every single command, see here:
Download here
Disclaimer
I am not part of the development team.
It is a free (for personal use) and highly customizable and documented, persistent FUD RAT targetting 64-bit Windows, including but not limited to:
Stealers, ransomware and a module allowing users to send custom messages and file attachments (including payloads) from infected users' accounts to all Discord friends, servers and server members.
Proof
For a showcase of some core features, see here:
It includes stealer capabilities that can retrieve:
- Browser creditcards/passwords/history etc. (including Chrome v20 encryption)
- Discord tokens
- Crypto wallets
- Wifi logins
- Logged keystrokes (keylogger)
- Recorded microphone audio
It also lets users specify messages and files that will be sent from all infected host's Discord accounts to all:
- Servers
- Friends
- Server members
Persistence
The payloads leverage a Windows vulnerability to gain persistent, SYSTEM-level (injected into an already-existing svchost process) access (on machine startup, not user-login).
This also means that, once a machine is infected, you have access to all users' files.
Ransomware
It also comes with ransomware functionality allowing you to drop and set custom ransom notes and wallpapers upon remotely encrypting drives/folders.
After sending the ransomware command, the used AES-256 encryption key is returned to the server, which can later be used to `deransom` the affected machine.
Discord/FTP exfiltration
Data can be stolen and retrieved to an active server, but users can also specify Discord webhooks or FTP servers to exfiltrate the stolen data to.
(self-hosted) Serverless configurations
The builder is higly customizable and allows you to embed commands that will be run upon payload execution.
This can be combined with the aforementioned Discord exfiltration to create payloads that do not depend on any self-hosted server.
Advanced features
It also features many commands fit for advanced users such as:
- Process migration
- In-memory payload/DLL execution
- Token impersonation
The provided tools include:
- CLI builder (Windows/Linux)
- CLI server (Windows/Linux)
- Multi-purpose GUI (Windows/Linux)
For a detailed guide on using the provided tools, as well as documentation specifying the use of every single command, see here:
Download here
I am not part of the development team.
