01.10.2026

GhostFlood Stealer v5.0 — the flagship product for professionals

Professional endpoint management in one workspace

🆕 WHAT’S NEW IN V5.0

  • Dynamic Campaigns (Campaign ID) — manage multiple builds simultaneously. One Stager, different payloads for different targets.
  • Configurable Download Timeout in GUI — flexibility for slow servers.
  • Fine Tuning moved to a dedicated tab — clean interface.
  • All numeric parameters in one place — limits, intervals, delays.
  • Simultaneous POST/GET server support — universal payload.php.
  • One-click “Select All” for modules, browsers, messengers, wallets.
  • Each module with icon and detailed description — intuitive navigation.
  • Save/Load config in JSON — transfer settings between projects.
  • Complete server package for client — one-command installation.

💎 KEY FEATURES

  • 30+ browsers with Chrome 127+ decryption (V20 Decrypt via SYSTEM DPAPI)
  • 40+ crypto wallets — browser extensions + desktop applications
  • 12+ messengers with flexible collection methods (inject, LevelDB, tdata)
  • Full-featured RAT with graphical server (11 tabs)
  • Unique Dead Drop — data is never lost when server is unreachable
  • Every build has unique signatures (polymorphism)
  • Binder with PDF, DOC, JPG, MP4 and other format masking
  • Multi-layered anti-removal protection (Watchdog, ACL, ADS, copies)
  • Auto-infection of USB flash drives
  • Telegram bot and Discord Webhook C2
  • Dynamic payloads with Campaign ID — victim segmentation by campaigns
  • File grabber by masks + system information

GhostFlood Stealer v5.0 is a flagship professional tool. It combines a powerful data stealer, a full-featured RAT with GUI, USB self-spreading, Telegram & Discord C2, multi-layered anti-removal protection, and a unique Dead Drop system for autonomous offline operation.


🌐 SERVER

  • One-command install: sudo bash install.sh
  • Auto-configure Apache + PHP + SQLite
  • “Upload Dashboard” button from builder
  • Cloudflare, HTTPS, SSL support
  • Nginx config generator
  • Dynamic payloads via payload.php
  • .htaccess protection (file whitelist)
  • Dashboard password
  • Telegram notifications for critical events

🔐 PROTECTION & ANTIVIRUS EVASION

🛡

  • ANTI-ANALYSIS
  • WINDOWS BYPASS
  • SIGNATURE MUTATION (each build is unique)
  • STAGER PROTECTION
  • ANTI-REMOVAL PROTECTION

📊 ROI POTENTIAL
Crypto wallets: $500 – $50,000+
Exchange passwords: $1,000 – $100,000+
Bank accounts: $500 – $10,000+
Dynamic campaigns: ROI × N (different targets)
Starter ($500) pays for itself with a single successful log.


🌐 BROWSERS

  • 30+ Chromium and Firefox browsers.
  • Collection: passwords, cookies, credit cards, history, bookmarks, extensions, downloads
  • Technologies:
  • V20 Decrypt (Chrome 127+) — SYSTEM DPAPI + NCrypt via lsass.exe
  • V10/V11 — AES-GCM via DPAPI
  • Firefox — NSS3 via dynamic DLL loading
  • Yandex — AES-GCM with AAD via local_encryptor_data
  • Flexible settings: limits, collection modes (all/top/count), filters, V20 on/off

👛 CRYPTO WALLETS

  • BROWSER EXTENSIONS (16)
  • DESKTOP (22)
  • EXTRACTS:
  • Addresses (BTC, ETH, SOL, TRX, LTC, DOGE, XRP, ADA, XMR, TON, +)
  • Private keys (WIF, HEX, Base58, keypair)
  • Seed phrases (BIP39 validation against 2048-word dictionary)
  • xprv/xpub/ypub/zpub (extended keys)
  • Keystore (Web3 Secret Storage)
  • MetaMask Vault (bruteforce 50 common passwords)
  • Config files, .dat, .json, .sqlite

💬 MESSENGERS & EMAIL

  • MESSENGERS:
  • Discord — inject / LevelDB / combined method (V10 decryption)
  • Telegram — tdata copy / contact parsing
  • Steam — sessions + trade links + JWT tokens + config.vdf parsing
  • Signal — database
  • Skype, Viber, WhatsApp (Win32 + UWP), Slack, Element (Matrix tokens)
  • GitHub Desktop, GitKraken, SourceTree
  • EMAIL:
  • Outlook (registry + OST/PST copy)
  • Windows Mail (UWP), Mailbird, eM Client, Postbox
  • Claws Mail, Becky!, Foxmail, The Bat!, IncrediMail
  • Windows Credential Manager (decryption via DPAPI)

🔐 2FA / EXCHANGES / MANAGERS / BANKS / GAMING

  • 2FA/TOTP:
  • Authy Desktop, Google Authenticator (backups), Aegis, 2FAS, WinAuth
  • QR codes from screenshots (otpauth:// search in binary data)
  • Browser extensions (Authenticator, Authy, Microsoft Authenticator)
  • CRYPTO EXCHANGES:
  • Binance, Bybit, OKX, Coinbase, Kraken, KuCoin, Bitget, Gate.io, Huobi, PancakeSwap, Uniswap, 1inch, SushiSwap, Aave, Compound, Curve, +10 more
  • PASSWORD MANAGERS:
  • KeePass, Bitwarden, 1Password, LastPass, Dashlane, NordPass, RoboForm, Keeper, Enpass (+ browser extensions)
  • BANKS:
  • 80+ banks worldwide (Monobank, Privat24, Revolut, Wise, PayPal, Skrill, Chase, + Brazil, India, Kazakhstan, Turkey, Nigeria…)
  • GAMING:
  • Steam, Epic Games, Battle.net, Ubisoft, Origin, Riot Games, Minecraft, Discord tokens

📋 CLIPPER + KEYLOGGER + MEDIA

  • CLIPPER:
  • Real-time crypto address replacement (50+ cryptocurrencies)
  • Private key detection (WIF, HEX, Base58)
  • Seed phrase detection (12/15/18/21/24 words)
  • Discord, Telegram, Steam trade link token detection
  • SHA256 cache (last 500) — no duplicates
  • Screenshot on crypto detection
  • KEYLOGGER:
  • 5 keyboard layouts (RU/DE/FR/ES/US)
  • Special keys, CapsLock, Shift, AltGr
  • Window and process grouping
  • Process filtering
  • Clean + Raw output
  • SCREENSHOTS:
  • All monitors, DPI-aware, mouse cursor
  • JPEG with configurable quality
  • Triggers: startup, interval, crypto detection
  • WEBCAM: AForge + PowerShell fallback + screenshot backup
  • MICROPHONE: WAV recording, configurable duration

🖥 SYSTEM INFO + FILES

  • Wi-Fi passwords (SSID, password, auth type)
  • RDP sessions (server, username, password)
  • SSH keys (PuTTY, KiTTY, Known Hosts)
  • FTP/FileZilla (host, port, username, password)
  • VPN configs (OpenVPN, WireGuard, ProtonVPN)
  • Cloud CLI tokens (AWS, Azure, GCloud, DigitalOcean)
  • Proxy clients (Proxifier, Shadowsocks)
  • TeamViewer / AnyDesk
  • WinSCP / PuTTY / KiTTY / mRemoteNG / Bitvise / SecureCRT / Xshell
  • FILE GRABBER: search for *.key, *.wallet, *.secret, *.seed, *.dat, *.json
  • PROCESSES: list + tree with owner, command line, parent PID
  • APPLICATIONS: installed with filter, dates, paths

🐀 RAT — REMOTE ADMINISTRATION

Graphical server (WPF). 11 modules:

  • Files — full file manager (drives, folders, upload, download)
  • Shell — interactive cmd.exe in real time
  • Screen — live streaming (configurable FPS, quality)
  • Keylogger — live with process filter
  • Processes — list + tree, kill, start
  • Registry — read, write, delete, export to .reg
  • Microphone — live audio + WAV recording
  • SOCKS5 — proxy tunnel through victim
  • Miner — XMRig with auto-idle (mines when user is away)
  • Loader — in-memory load, RunPE, stealer update
  • Dead Drop — decrypt and view accumulated data
  • Password-protected RAT server access
  • Stealer password for registration
  • All settings transmitted encrypted

🔄 DEAD DROP + FAILOVER

Server unreachable → data is never lost.

  • AES-256-GCM encryption
  • Upload to Pastebin / Dpaste / local file
  • Failover: main URL → backup URL → Dead Drop Check
  • Auto-send accumulated data on reconnect
  • Configurable check intervals and timeouts

🔗 BINDER

  • Binding with PDF, DOC, XLS, JPG, PNG, MP3, MP4, ZIP, TXT
  • Auto-icon from file type
  • Auto-description, auto-VERSIONINFO
  • RTLO masking (victim sees .pdf instead of .exe)
  • Preview of final file appearance
  • SmartScreen warning display
  • Extension choice: EXE / SCR / CPL

🦠 WORM + C2

  • USB WORM:
  • Auto-infect USB drives on connection
  • Original files hidden in System_{guid} folder
  • Trap shortcut with folder/document icon
  • Autorun.inf for legacy systems
  • TELEGRAM C2:
  • /screen, /info, /passwords, /processes, /keylog, /wallets
  • /shell , /file , /download
  • /kill, /help
  • Screenshot and file upload via Telegram API
  • DISCORD C2:
  • Periodic status reports
  • Large file splitting (>8MB chunks)
  • Rate limiting (ban protection)
  • Priority message queue