🔒 satan core | windows infostealer ops platform
builder, live c2 panel, and intelligence pipeline in one stack.
🛠 saas builder
compile unique x64 stubs on demand. pick modules, set your gate, get a fresh polymorphic build with per-build ecies keys. local av check, zero uploads to cloud scanners.
📦 full spectrum capture
• chromium (v20 abe bypass), firefox family
• live cookie dbs via handle duplication + wal
• 40+ wallets, telegram, discord, signal, whatsapp
• steam, filezilla, winscp, azure/msal, wifi keys
• screenshot, clipboard, system info, file grabber
🛡 evasion stack
• unhooked ntdll + indirect syscalls
• amsi / etw patched in-memory, xored per build
• .text encrypted during timed sleep
• weighted anti-vm / sandbox scoring
• salted api hashing, ppid spoofing
• offline geofence, optional staged delivery (no disk touch)
📡 exfil & resilience
• ecies x25519+aes-gcm, multi-gate failover
• encrypted spool for failed drops
• telegram dead-drop fallback
• optional persistence + ads self-delete
🖥 panel
real-time dashboard, decrypted logs, one-click exports, totp 2fa, audit trail.
💰 pricing
one plan, everything in: $700 / month. crypto only (btc, eth, ltc, xmr, sol, bnb, tron) via plisio. your console unlocks automatically the moment the payment confirms.
🌐 https://satan-core.com
register your seat, pay, operate in minutes.
support: @ghxstfud
builder, live c2 panel, and intelligence pipeline in one stack.
🛠 saas builder
compile unique x64 stubs on demand. pick modules, set your gate, get a fresh polymorphic build with per-build ecies keys. local av check, zero uploads to cloud scanners.
📦 full spectrum capture
• chromium (v20 abe bypass), firefox family
• live cookie dbs via handle duplication + wal
• 40+ wallets, telegram, discord, signal, whatsapp
• steam, filezilla, winscp, azure/msal, wifi keys
• screenshot, clipboard, system info, file grabber
🛡 evasion stack
• unhooked ntdll + indirect syscalls
• amsi / etw patched in-memory, xored per build
• .text encrypted during timed sleep
• weighted anti-vm / sandbox scoring
• salted api hashing, ppid spoofing
• offline geofence, optional staged delivery (no disk touch)
📡 exfil & resilience
• ecies x25519+aes-gcm, multi-gate failover
• encrypted spool for failed drops
• telegram dead-drop fallback
• optional persistence + ads self-delete
🖥 panel
real-time dashboard, decrypted logs, one-click exports, totp 2fa, audit trail.
💰 pricing
one plan, everything in: $700 / month. crypto only (btc, eth, ltc, xmr, sol, bnb, tron) via plisio. your console unlocks automatically the moment the payment confirms.
🌐 https://satan-core.com
register your seat, pay, operate in minutes.
support: @ghxstfud
Satan-Core
Satan Core: Satan Stealer Platform & Cybercrime Intelligence
Satan Core, the infostealer operations platform: polymorphic builder, Defender-evading implant, real-time loot decryption. With the Solid Snaku Research intelligence module, sold separately.
⚡ UMBRA // Self-Hosted Windows C2 / RAT
Your own teamserver, your own infra, your own beacons. No SaaS. No gatekeeper. Lifetime license.
🛠 BUILDER
Compile unique beacons on demand: EXE, DLL, SVC, shellcode. Pick modules, set host/port, get a polymorphic build baked with per-install X25519 + AES-GCM keys. Local build, zero cloud scanners.
📦 FULL SPECTRUM OPS
• Command shell, file manager, process list, inject, migrate
• hVNC, remote desktop, keylogger, screenshot, clipboard
• Token grabber, hashdump, lateral movement, pivot, persist
• EDR checks, lockdown, BOF, .NET assembly loader, stealer
🛡 EVASION STACK
• Indirect syscalls + unhooked ntdll
• PPID spoofing, API hashing, string XOR per install
• Encrypted state at rest, cert pinning per server
• Anti-VM / sandbox scoring built in
📡 C2 & RESILIENCE
• HTTPS listener with malleable profiles
• Beacon rollover, sleep jitter, dead drop support
• SOCKS + port forwarding tabs for pivoting
• Encrypted events DB, capped audit trail
🖥 PANEL
Real-time sessions dashboard, module runner, builder, listeners, profiles, relays, operators. Everything from the browser at https://ip:8787/op
💰 $800 lifetime - one plan, full access
🛒 DM to buy, no test allowed.
📦 Delivery: clean .zip + install.sh. Deploy in minutes.
@ghxstfud
Your own teamserver, your own infra, your own beacons. No SaaS. No gatekeeper. Lifetime license.
🛠 BUILDER
Compile unique beacons on demand: EXE, DLL, SVC, shellcode. Pick modules, set host/port, get a polymorphic build baked with per-install X25519 + AES-GCM keys. Local build, zero cloud scanners.
📦 FULL SPECTRUM OPS
• Command shell, file manager, process list, inject, migrate
• hVNC, remote desktop, keylogger, screenshot, clipboard
• Token grabber, hashdump, lateral movement, pivot, persist
• EDR checks, lockdown, BOF, .NET assembly loader, stealer
🛡 EVASION STACK
• Indirect syscalls + unhooked ntdll
• PPID spoofing, API hashing, string XOR per install
• Encrypted state at rest, cert pinning per server
• Anti-VM / sandbox scoring built in
📡 C2 & RESILIENCE
• HTTPS listener with malleable profiles
• Beacon rollover, sleep jitter, dead drop support
• SOCKS + port forwarding tabs for pivoting
• Encrypted events DB, capped audit trail
🖥 PANEL
Real-time sessions dashboard, module runner, builder, listeners, profiles, relays, operators. Everything from the browser at https://ip:8787/op
💰 $800 lifetime - one plan, full access
🛒 DM to buy, no test allowed.
📦 Delivery: clean .zip + install.sh. Deploy in minutes.
@ghxstfud
🔒 FemtoCrypt // Windows x64 CryptoLock*r. No CRT. Seeded builds, recovery that round-trips.
🛠 BUILDER Unique x64 stubs on demand. Morph mode: opaque predicates, dead decoys, shuffled link order, shuffled import anchors. Every build, morph or not: its own string key and API-hash mask, from the seed.
📦 HIGH-VELOCITY CRYPTO • X25519 (5×51-bit limbs) + AES-256-CTR • Files over 1 MB: 30% intermittent, 64 KB chunks. Smaller files: full file • Keystream locked to the chunk's absolute offset • HMAC-SHA256 cut to 128 bits. Files and C2. Bad tag, reject • One chunk map. Locker, decryptor, Python recovery • LOCKER_MAGIC_V2 trailer. No double-encrypt
🛡 EVASION STACK • Halo's Gate, indirect syscall gadgets. 34 SSNs • NTDLL restored from \KnownDlls. Used stubs only. Hooked prologues only. OS hotpatches stay • Ekko sleep. .text XOR'd through NtProtectVirtualMemory • 15-point score. RDTSC, RAM, disk, screen, input idle, and the rest • "Microsoft Hv" whitelisted. VBS/HVCI is not scored as a foreign VM • SyscallsVerifyStubs() flags a re-hook. It adds score. It does not unhook again • Score does not abort unless the build is AVM_ENFORCE • Throttle: 25 ms + 0–100 ms jitter per file. ~13 files/s per worker. ~50 files/s on 4 workers
📡 PROPAGATION & LATERAL • AD computers via wldap32. NEGOTIATE bind, current token, no password. Any domain user. The search is visible • Domain admin. SYSVOL writes are audited • Logon script in the Default Domain Policy • Immediate task: payload on NETLOGON, ScheduledTasks.xml merged. SYSTEM at the next gpupdate • 4 lateral threads. Cursor and count via GCC atomics • 4 encryption threads. IOCP used as a ticket queue • Encrypt path only: NtCreateFile, NtReadFile, NtWriteFile. Walks, exfil, notes, and staging stay on Win32
📡 C2 & RESILIENCE • 1 path out of 8, chosen per seed. No runtime rotate • 3 fallback host slots. Empty unless set at build. ECDH keys survive the hop • femtod: one operator, many victims. Threaded listener, console on a Unix socket • SQLite. Each victim record sealed with AES-256-GCM
🛠 BUILDER Unique x64 stubs on demand. Morph mode: opaque predicates, dead decoys, shuffled link order, shuffled import anchors. Every build, morph or not: its own string key and API-hash mask, from the seed.
📦 HIGH-VELOCITY CRYPTO • X25519 (5×51-bit limbs) + AES-256-CTR • Files over 1 MB: 30% intermittent, 64 KB chunks. Smaller files: full file • Keystream locked to the chunk's absolute offset • HMAC-SHA256 cut to 128 bits. Files and C2. Bad tag, reject • One chunk map. Locker, decryptor, Python recovery • LOCKER_MAGIC_V2 trailer. No double-encrypt
🛡 EVASION STACK • Halo's Gate, indirect syscall gadgets. 34 SSNs • NTDLL restored from \KnownDlls. Used stubs only. Hooked prologues only. OS hotpatches stay • Ekko sleep. .text XOR'd through NtProtectVirtualMemory • 15-point score. RDTSC, RAM, disk, screen, input idle, and the rest • "Microsoft Hv" whitelisted. VBS/HVCI is not scored as a foreign VM • SyscallsVerifyStubs() flags a re-hook. It adds score. It does not unhook again • Score does not abort unless the build is AVM_ENFORCE • Throttle: 25 ms + 0–100 ms jitter per file. ~13 files/s per worker. ~50 files/s on 4 workers
📡 PROPAGATION & LATERAL • AD computers via wldap32. NEGOTIATE bind, current token, no password. Any domain user. The search is visible • Domain admin. SYSVOL writes are audited • Logon script in the Default Domain Policy • Immediate task: payload on NETLOGON, ScheduledTasks.xml merged. SYSTEM at the next gpupdate • 4 lateral threads. Cursor and count via GCC atomics • 4 encryption threads. IOCP used as a ticket queue • Encrypt path only: NtCreateFile, NtReadFile, NtWriteFile. Walks, exfil, notes, and staging stay on Win32
📡 C2 & RESILIENCE • 1 path out of 8, chosen per seed. No runtime rotate • 3 fallback host slots. Empty unless set at build. ECDH keys survive the hop • femtod: one operator, many victims. Threaded listener, console on a Unix socket • SQLite. Each victim record sealed with AES-256-GCM