Professional endpoint management in one workspace
🆕 WHAT’S NEW IN V5.0
- Dynamic Campaigns (Campaign ID) — manage multiple builds simultaneously. One Stager, different payloads for different targets.
- Configurable Download Timeout in GUI — flexibility for slow servers.
- Fine Tuning moved to a dedicated tab — clean interface.
- All numeric parameters in one place — limits, intervals, delays.
- Simultaneous POST/GET server support — universal payload.php.
- One-click “Select All” for modules, browsers, messengers, wallets.
- Each module with icon and detailed description — intuitive navigation.
- Save/Load config in JSON — transfer settings between projects.
- Complete server package for client — one-command installation.
💎 KEY FEATURES
- 30+ browsers with Chrome 127+ decryption (V20 Decrypt via SYSTEM DPAPI)
- 40+ crypto wallets — browser extensions + desktop applications
- 12+ messengers with flexible collection methods (inject, LevelDB, tdata)
- Full-featured RAT with graphical server (11 tabs)
- Unique Dead Drop — data is never lost when server is unreachable
- Every build has unique signatures (polymorphism)
- Binder with PDF, DOC, JPG, MP4 and other format masking
- Multi-layered anti-removal protection (Watchdog, ACL, ADS, copies)
- Auto-infection of USB flash drives
- Telegram bot and Discord Webhook C2
- Dynamic payloads with Campaign ID — victim segmentation by campaigns
- File grabber by masks + system information
GhostFlood Stealer v5.0 is a flagship professional tool. It combines a powerful data stealer, a full-featured RAT with GUI, USB self-spreading, Telegram & Discord C2, multi-layered anti-removal protection, and a unique Dead Drop system for autonomous offline operation.
🌐 SERVER
- One-command install: sudo bash install.sh
- Auto-configure Apache + PHP + SQLite
- “Upload Dashboard” button from builder
- Cloudflare, HTTPS, SSL support
- Nginx config generator
- Dynamic payloads via payload.php
- .htaccess protection (file whitelist)
- Dashboard password
- Telegram notifications for critical events

🔐 PROTECTION & ANTIVIRUS EVASION

🛡
- ANTI-ANALYSIS
- WINDOWS BYPASS
- SIGNATURE MUTATION (each build is unique)
- STAGER PROTECTION
- ANTI-REMOVAL PROTECTION
📊 ROI POTENTIAL
Crypto wallets: $500 – $50,000+
Exchange passwords: $1,000 – $100,000+
Bank accounts: $500 – $10,000+
Dynamic campaigns: ROI × N (different targets)
Starter ($500) pays for itself with a single successful log.
🌐 BROWSERS

- 30+ Chromium and Firefox browsers.
- Collection: passwords, cookies, credit cards, history, bookmarks, extensions, downloads
- Technologies:
- V20 Decrypt (Chrome 127+) — SYSTEM DPAPI + NCrypt via lsass.exe
- V10/V11 — AES-GCM via DPAPI
- Firefox — NSS3 via dynamic DLL loading
- Yandex — AES-GCM with AAD via local_encryptor_data
- Flexible settings: limits, collection modes (all/top/count), filters, V20 on/off
👛 CRYPTO WALLETS
- BROWSER EXTENSIONS (16)
- DESKTOP (22)
- EXTRACTS:
- Addresses (BTC, ETH, SOL, TRX, LTC, DOGE, XRP, ADA, XMR, TON, +)
- Private keys (WIF, HEX, Base58, keypair)
- Seed phrases (BIP39 validation against 2048-word dictionary)
- xprv/xpub/ypub/zpub (extended keys)
- Keystore (Web3 Secret Storage)
- MetaMask Vault (bruteforce 50 common passwords)
- Config files, .dat, .json, .sqlite

💬 MESSENGERS & EMAIL
- MESSENGERS:
- Discord — inject / LevelDB / combined method (V10 decryption)
- Telegram — tdata copy / contact parsing
- Steam — sessions + trade links + JWT tokens + config.vdf parsing
- Signal — database
- Skype, Viber, WhatsApp (Win32 + UWP), Slack, Element (Matrix tokens)
- GitHub Desktop, GitKraken, SourceTree
- EMAIL:
- Outlook (registry + OST/PST copy)
- Windows Mail (UWP), Mailbird, eM Client, Postbox
- Claws Mail, Becky!, Foxmail, The Bat!, IncrediMail
- Windows Credential Manager (decryption via DPAPI)
🔐 2FA / EXCHANGES / MANAGERS / BANKS / GAMING
- 2FA/TOTP:
- Authy Desktop, Google Authenticator (backups), Aegis, 2FAS, WinAuth
- QR codes from screenshots (otpauth:// search in binary data)
- Browser extensions (Authenticator, Authy, Microsoft Authenticator)
- CRYPTO EXCHANGES:
- Binance, Bybit, OKX, Coinbase, Kraken, KuCoin, Bitget, Gate.io, Huobi, PancakeSwap, Uniswap, 1inch, SushiSwap, Aave, Compound, Curve, +10 more
- PASSWORD MANAGERS:
- KeePass, Bitwarden, 1Password, LastPass, Dashlane, NordPass, RoboForm, Keeper, Enpass (+ browser extensions)
- BANKS:
- 80+ banks worldwide (Monobank, Privat24, Revolut, Wise, PayPal, Skrill, Chase, + Brazil, India, Kazakhstan, Turkey, Nigeria…)
- GAMING:
- Steam, Epic Games, Battle.net, Ubisoft, Origin, Riot Games, Minecraft, Discord tokens
📋 CLIPPER + KEYLOGGER + MEDIA
- CLIPPER:
- Real-time crypto address replacement (50+ cryptocurrencies)
- Private key detection (WIF, HEX, Base58)
- Seed phrase detection (12/15/18/21/24 words)
- Discord, Telegram, Steam trade link token detection
- SHA256 cache (last 500) — no duplicates
- Screenshot on crypto detection
- KEYLOGGER:
- 5 keyboard layouts (RU/DE/FR/ES/US)
- Special keys, CapsLock, Shift, AltGr
- Window and process grouping
- Process filtering
- Clean + Raw output
- SCREENSHOTS:
- All monitors, DPI-aware, mouse cursor
- JPEG with configurable quality
- Triggers: startup, interval, crypto detection
- WEBCAM: AForge + PowerShell fallback + screenshot backup
- MICROPHONE: WAV recording, configurable duration
🖥 SYSTEM INFO + FILES
- Wi-Fi passwords (SSID, password, auth type)
- RDP sessions (server, username, password)
- SSH keys (PuTTY, KiTTY, Known Hosts)
- FTP/FileZilla (host, port, username, password)
- VPN configs (OpenVPN, WireGuard, ProtonVPN)
- Cloud CLI tokens (AWS, Azure, GCloud, DigitalOcean)
- Proxy clients (Proxifier, Shadowsocks)
- TeamViewer / AnyDesk
- WinSCP / PuTTY / KiTTY / mRemoteNG / Bitvise / SecureCRT / Xshell
- FILE GRABBER: search for *.key, *.wallet, *.secret, *.seed, *.dat, *.json
- PROCESSES: list + tree with owner, command line, parent PID
- APPLICATIONS: installed with filter, dates, paths
🐀 RAT — REMOTE ADMINISTRATION

Graphical server (WPF). 11 modules:
- Files — full file manager (drives, folders, upload, download)
- Shell — interactive cmd.exe in real time
- Screen — live streaming (configurable FPS, quality)
- Keylogger — live with process filter
- Processes — list + tree, kill, start
- Registry — read, write, delete, export to .reg
- Microphone — live audio + WAV recording
- SOCKS5 — proxy tunnel through victim
- Miner — XMRig with auto-idle (mines when user is away)
- Loader — in-memory load, RunPE, stealer update
- Dead Drop — decrypt and view accumulated data
- Password-protected RAT server access
- Stealer password for registration
- All settings transmitted encrypted
🔄 DEAD DROP + FAILOVER
Server unreachable → data is never lost.
- AES-256-GCM encryption
- Upload to Pastebin / Dpaste / local file
- Failover: main URL → backup URL → Dead Drop Check
- Auto-send accumulated data on reconnect
- Configurable check intervals and timeouts

🔗 BINDER

- Binding with PDF, DOC, XLS, JPG, PNG, MP3, MP4, ZIP, TXT
- Auto-icon from file type
- Auto-description, auto-VERSIONINFO
- RTLO masking (victim sees .pdf instead of .exe)
- Preview of final file appearance
- SmartScreen warning display
- Extension choice: EXE / SCR / CPL
🦠 WORM + C2
- USB WORM:
- Auto-infect USB drives on connection
- Original files hidden in System_{guid} folder
- Trap shortcut with folder/document icon
- Autorun.inf for legacy systems
- TELEGRAM C2:
- /screen, /info, /passwords, /processes, /keylog, /wallets
- /shell , /file , /download
- /kill, /help
- Screenshot and file upload via Telegram API
- DISCORD C2:
- Periodic status reports
- Large file splitting (>8MB chunks)
- Rate limiting (ban protection)
- Priority message queue

