v2.0.0 July 17, 2026
Linux Agent, Advanced Evasion, Credential Theft
Linux Agent
Full native Linux implant with the same wire protocol as Windows:
- HTTPS transport via OpenSSL
- .so module loader (memfd_create + dlopen for fileless execution)
- Direct syscall stubs (18 raw syscalls, zero hookable PLT entries)
- Sleep obfuscation (XOR .text section during nanosleep)
- String obfuscation (compile-time XOR, zero cleartext IOCs)
- Anti-sandbox (CPU count, uptime, DMI vendor, disk size)
- Anti-debug (ptrace self-check, /proc/self/status TracerPid)
- Ptrace-based process injection (memfd_create + execveat in target)
- Fileless persistence (crontab + memfd_create one-liner)
- Polymorphic builds (function reorder, junk code, padding, decoy strings)
- Process masquerade (argv[0] + prctl PR_SET_NAME)
Windows Evasion Upgrades
- Tampered syscalls — VEH handler intercepts at ntdll
syscallinstruction boundary, swaps SSN and args. Return address points into ntdll, defeating return-address analysis. - Foliage sleep obfuscation — APC-based alternative to Ekko. 7-step ROP chain via suspended thread + NtContinue APCs. No RWX shellcode page.
- PE fluctuation — Timer-driven encrypt-at-rest with VEH handler. Only the accessed page is live at any moment.
- Heap encryption — HeapWalk() encrypts all non-default process heaps during sleep. Catches allocations SleepMaskRegister doesn’t know about.
- Process ghosting — SEC_IMAGE from delete-pending file. On-disk forensics find nothing.
- Process herpaderping — NtCreateSection then overwrite file with clean PE before process runs.
- Module overloading — SEC_IMAGE mapping without PEB loader-list entry. Alternative to module stomping.
- Threadless injection — Hook target export → CALL to memory hole → self-healing shellcode. No thread, no APC, no context modification.
- LoadLibrary Proxy v2 — Selective manual mapping of clr.dll/clrjit.dll to suppress kernel-mode image-load notifications. API set resolution, TLS processing, fail-open design.
Credential Theft
- Chrome credential dump — App-Bound Encryption v20+ full decryption chain (DPAPI as SYSTEM via csrss token theft → CNG NCryptDecrypt → AES-256-GCM per cookie/login)
- Firefox credential dump — key4.db ASN.1 DER parsing → PBKDF2-SHA256 → AES-256-CBC master key → logins.json decrypt
- RDP credential theft — DLL injection into mstsc.exe with hardware breakpoints on SspiPrepareForCredRead + CredIsMarshaledCredentialW + CryptProtectMemory
- LSASS handle duplication — NtQuerySystemInformation(SystemHandleInformation) + DuplicateHandle instead of OpenProcess
- Silent process exit dump — WerFault.exe triggered via RtlReportSilentProcessExit registry configuration
- Race condition dump — seclogon.dll CreateProcessWithLogonW race for LSASS handle acquisition
- SAM dump — In-memory extraction via registry API with PEK decryption (no files on disk)
Other Additions
- ETW session hijacking — Restart named ETW sessions with bogus LogFileName (Procmon, Sysmon)
- Better ETW patching — NOP out
call EtwpEventWriteFullinside EtwEventWrite body (alternative to ret-patch) - DLL load notification unhooking — Remove EDR LdrRegisterDllNotification callbacks from PEB
- BOF chaining — Queue up to 16 BOFs as single atomic task
- Machine lock — Bind agent to specific hardware via SMBIOS UUID
Operator
- Debug build options (
--debug-stub,--debug-migrate) removed from CLI/web UI (still available in build_prod.py for development)