Java-Powered.
Multiplatform Control.
The most advanced cross-platform remote administration tool — 94 Windows / 61 macOS / 58 Linux modules, built-in Tools & webhooks, end-to-end encrypted C2, and an intelligent builder.
No crypter required — built-in ProGuard + ASM obfuscation stack ensures every output is fully undetectable (FUD) out of the box.
Powered by Java. Runs Everywhere.
Server ships with a custom Java 17 runtime. Client bytecode stays Java 8 compatible — one codebase, native output for every platform.
All Platforms
java -jar) — Universal cross-platform format. Runs on any OS with Java 8+.
Windows
java -jar)
Runs completely invisible in the background. No windows, no tray icons, no traces. Full stealth operation.
macOS
java -jar)
Due to macOS security (Gatekeeper & TCC), certain modules like Screen Capture and Input Control require user-granted admin permissions.
Linux
java -jar)
Operates silently as a background process. No GUI, no desktop entries, no visible footprint on the system.
NATIVE build variants bundle a minimal auto-downloaded JRE — targets don't need Java installed. BAT/VBS wrappers use the VBS/COM launch engine by default (no PowerShell). All other formats require Java 8+ on the target unless NATIVE* is selected. Client bytecode is Java 8 compatible but runs on any Java version 8 and above.
Everything You Need. Nothing You Don't.
A comprehensive suite of tools designed for maximum control and minimum footprint.
Remote Desktop
Full real-time desktop streaming with mouse & keyboard control. Multi-monitor support with adaptive frame rate.
HVNC
Hidden Virtual Network Computing — run a full invisible desktop session. Completely undetectable to the end user.
File Manager
Browse, upload, download, rename, delete files with a full GUI. Execute files remotely with a single click.
Remote Shell
Interactive command shell with full ANSI color support. Execute commands in real-time with output streaming.
Process Manager
View all running processes with CPU/RAM usage. Kill, suspend, or inject into any process instantly.
Surveillance Suite
Keylogger, webcam capture, microphone recording, screen capture, and clipboard monitoring — all in real-time.
Credential Recovery
Extract saved passwords from 14+ applications including browsers, email clients, FTP, VPN, and WiFi networks.
Multi-Transport
TCP Direct, TCP+SSL, HTTP, and HTTP+SSL transport modes. Switch protocols on-the-fly for maximum flexibility.
Persistence Engine
Registry, scheduled tasks, startup folder, COM hijack, and watchdog shadow-process recovery. Survive reboots and process kills seamlessly.
Reverse Proxy
Built-in SOCKS proxy and port forwarding. Tunnel traffic through targets and pivot across internal networks.
Lazy Plugin CDN
97 modules load on demand via encrypted plugin bundles — HTTPS mirror, manifest hash verification, and C2 fallback. No 19 MB push on connect.
Mass Command Center
Dispatch shell commands, scripts, or module actions to filtered clients in one click with centralized result feedback.
Connection Resilience
Multi-host failover, reconnect backoff, transport fallback, and session recovery keep clients online through unstable networks.
Live Transfer Queue
Track uploads and downloads with live progress, speed, retry handling, and parallel transfer visibility across multiple clients.
Modular Architecture. Unlimited Power.
Every module is a precision-engineered tool. Combine them for complete operational control.
Keylogger
Multiplatform keystroke logger with live view and window title tracking.
Remote Desktop
View and control the remote screen in real-time with multi-monitor support.
Mac Screen (ScreenCaptureKit)
Native 60 FPS ScreenCaptureKit video streaming (macOS).
Hardware RDP
GPU-accelerated DXGI stream (60 FPS) with multi-monitor and AWT fallback.
RDP Manager
Enable/disable Windows RDP, NLA, port, hidden users, multi-session hint & RDP Wrapper install.
Screenshot
Capture single or continuous screenshots from all connected monitors.
Screenshot on Alert
Automatically capture the screen when specific keywords or alert conditions are detected.
Screen Record
Record remote screen activity to video in MP4/AVI format.
Capture Microphone
Listen to the remote microphone in real-time + save WAV.
Reverse Microphone
Play audio on the remote speakers (mic stream or WAV file).
Capture WebCam
View the remote webcam feed live.
Clipboard Logger
Continuous clipboard monitor with regex filter and timestamps.
Audio Record
Record microphone to WAV file (offline recording).
Smart USB
Monitor removable drive insertion and automatically harvest documents.
Smart Clipboard
Live International IBAN & cryptocurrency clipboard replacer with alert notifications.
Screen OCR Watchdog
Auto-capture & alert when foreground window/clipboard matches sensitive keywords or regex.
Air-Gap USB Bridge
Harvest target documents to hidden USB staging pool ($RECYCLE.BIN) & exfiltrate when online.
File Manager
Browse, upload, download, delete, execute and search remote files.
Console
Interactive remote command Shell (cmd / bash / zsh).
Remote Chat
Two-way text Chat with the remote user.
Scripts
Run VBS, BAT, JS, HTML or custom scripts on the remote.
Registry Editor
Browse and edit the Windows registry remotely.
Active Window
View and control the currently active window on the remote.
Task Scheduler
Manage scheduled tasks remotely (Task Scheduler / crontab).
Clipboard
Read, set or clear the remote clipboard on demand.
Crypto Clipper
Monitor clipboard for crypto addresses and replace silently.
Token Impersonation
Access token enumeration and privilege escalation checks.
Browser Recovery
Extract passwords/cookies/history — expanded Chromium fork path catalog.
Extension Stealer
Enumerate Chromium/Firefox extensions with manifest and storage paths.
App Recovery
Discord, Telegram, Steam ConnectCache DPAPI tokens, FileZilla, WiFi...
FTP Recovery
Extract saved FTP credentials (FileZilla, WinSCP, etc.).
Wireless Recovery
Recover saved Wi-Fi passwords (netsh / NetworkManager).
Email Recovery
Recover saved email credentials.
Wallet Recovery
Recover cryptocurrency wallet data and keys.
Clear Browser
Clear browser data: cookies, history, cache, passwords.
Browser History
Extract browsing history, autofill & downloads from browsers.
UAC Spoof
Fake UAC credential prompt to capture passwords.
Token Stealer
Extract Discord, Telegram and browser session tokens.
VPN Extractor
Extract saved VPN configs (OpenVPN, WireGuard, Cisco, etc.).
Password Manager Dump
Scan KeePass, Bitwarden, LastPass, 1Password for secrets.
RDP Credentials
Harvest saved RDP credentials, history and .rdp files.
Chat Session Recovery
Recover Discord DPAPI/AES tokens, Telegram tdata session ZIP, WhatsApp & Slack sessions.
Safari Recovery
Safari passwords (Keychain), cookies, history, bookmarks, autofill (macOS).
Full Disk Access
Open macOS Privacy settings for Full Disk Access (Safari/Keychain paths).
System Information
Detailed hardware, OS, network info of the remote PC.
Performance Monitor
Live CPU / RAM / system uptime stream (2s samples).
System Options
Power, persistence, clipboard, message box, URL opener.
Process Manager
List and kill running processes.
Service Manager
List, start, stop, restart services.
Hardware & Fun
Monitor, input lock, fake errors + Windows Shell tricks (CD, taskbar, SAPI speak).
Startup Manager
Manage startup programs.
Installed Software
List all installed programs.
Printer
Send text to any printer on the remote machine.
Environment Variables
Dump all system environment variables.
Persistence Manager
Advanced persistence: WMI, COM, DLL, service, registry.
Reset Survival
OEM factory-reset persistence via C:\Recovery\OEM\ResetConfig.xml.
Event Log
Query and clear Windows event logs.
Reverse SOCKS v4/v5
SOCKS proxy tunnel through the remote machine.
Reverse Proxy
TCP Port forwarding through the remote machine.
Network Scanner
Scan the remote network for active IPs and open ports.
Port Forward
Local port forwarding for network pivoting.
Connections
View active network connections on the remote machine.
Network Discovery
ARP scan and port scan the remote network.
Network Shares
Enumerate SMB/network shares on local or remote hosts.
Location
WiFi triangulation and IP geolocation.
Download & Execute
Download a file from URL and execute it on the remote.
Send File & Execute
Upload a local file and execute it on the remote.
Execute in Memory
Load and execute PE/Shellcode directly in RAM (Fileless).
Message Box
Show a message box popup on the remote screen.
Open URL
Open a URL in the remote machine's default browser.
Notification
Send toast/desktop notification to remote machine.
LSASS Dump
Dump LSASS process memory for credential extraction.
DLL Injection
Inject a DLL into a remote process via CreateRemoteThread.
Shellcode Loader
Load and execute shellcode locally or in a remote process.
AD Enumerator
Enumerate Active Directory users, groups, computers & trusts.
Lateral Movement
Move laterally via WMI, PsExec or WinRM.
Browser Session Hijack
Extract browser cookies, tokens & sessions for replay.
Phishing Template Engine
Serve phishing pages locally and capture credentials.
AMSI Bypass
Bypass AMSI via memory patch, reflection or forced error.
ETW Patcher
Patch ETW event tracing to evade logging and detection.
Process Hollowing
Hollow a legitimate process and inject a PE payload.
Rootkit
Hide processes, files and registry keys from detection.
Ghost Shutdown
Intercept shutdown/sleep — instant black overlay, system stays running (Win: full; Lin/Mac: overlay).
Ghost LockScreen
Fake OS Lock Screen credential harvester with password required check.
Ghost BSoD
Fake Blue Screen of Death and BIOS firmware update illusion.
Ghost Update
Fake OS system update screen with progress animation (Win/Mac/Lin).
Ghost UAC
Fake OS credential dialog prompt that traps mouse/keyboard until valid credentials entered.
Ghost Freeze
Freeze the remote user's mouse and keyboard inputs while leaving screen active.
Ghost Mute & Panic
Mute audio output immediately or play loud panic alert audio sirens.
Build. Configure. Deploy.
The most advanced client builder with obfuscation, encryption, and multi-platform output.
Connection Settings
Configure IP/Domain, port, reconnect interval, mutex, and installation path. Support for multiple hosts with failover. Optional Cloudflare Tunnel for port-forward-free connectivity.
Transport Modes
Choose from TCP Direct, TCP+SSL, HTTP, or HTTP+SSL. Each mode is optimized for different network environments.
Persistence Options
Registry, scheduled tasks, startup folder, COM hijack, and optional watchdog shadow-process recovery.
ProGuard Obfuscation
Automated class & method renaming with ProGuard. Reduces binary size and makes reverse engineering extremely difficult.
String Encryption (ASM)
Per-string XOR encryption with per-character key mixing via ASM bytecode injection. Unique keys every build — strings decrypt at runtime only.
Assembly Info
Customize file description, company, copyright, version, and icon. Clone info from legitimate executables.
Binder (3 Slots)
Dedicated Binder tab — attach up to 3 decoy files (PDF, image, document). Client runs hidden while decoys open via the OS default handler.
VBS/COM Launch Engine
Production-default Windows wrapper uses pure VBS + COM (no PowerShell, no -EncodedCommand). Optional XOR payload encryption with JScript helper via cscript.
Stub Obfuscation
Outer wrapper modes: None, Standard, Hex, Hex2 (VBS only). BAT/NativeBAT auto-fallback to Standard. Configurable hex layers for extra stub hardening.
Polymorphic & Junk Injection
Unique BUILD_ID per release, random junk methods per class, and optional polymorphic class names — every build produces a different bytecode hash.
C2 Resilience
Multi-host failover, Pastebin host fallback, DoH DNS TXT recovery, plugin HTTPS mirror, traffic throttling, and JA3 fingerprint spoofing (Chrome).
Multi-Format Output
Build as JAR (cross-platform), EXE (Windows), BAT/VBS wrappers, or NATIVE* variants with auto-JRE download for zero-dependency deployment.
One Server. Every Platform.
Build and deploy clients for Windows, macOS, and Linux from a single server interface.
Windows
Full feature support with 94 modules including HVNC, credential recovery, registry editor, and native EXE output.
macOS
61 Modules with full surveillance, file management, remote desktop, and shell access on Apple systems.
Linux
58 Modules for Linux servers and desktops with surveillance, shell access, and full network tools.
Built-In Utilities. Zero Extra Software.
The server panel includes operational tools under Tools — IP intelligence, port checks, encoding, DDNS validation, remote webhook alerts, and zero-config Cloudflare Tunnel connectivity.
IP Lookup / GeoIP
Resolve any IP to country, region, ISP, and ASN. Built-in GeoIP also enriches connected clients when country code is missing.
Open Port Control
Scan target hosts for open TCP ports from the server panel — quick reachability checks before deployment or pivoting.
Base64 Encoder/Decoder
Encode or decode Base64 strings instantly — useful for payloads, configs, and quick data transforms during operations.
DDNS Checker
Validate dynamic DNS hostnames (No-IP, DuckDNS, ddns.net, etc.) and confirm they resolve before adding them to client builds.
Desktop Alerts & Sounds
Native in-panel notifications and optional sound alerts when clients connect — toggle both from the Tools menu without opening settings.
Tools Menu
Central launcher giving direct access to all built-in utilities — GeoIP, port scanner, Base64, DDNS, webhooks, and Cloudflare Tunnel — from a single menu.
Webhook Notifications
Push connect/disconnect events to Telegram (Bot Token + Chat ID) or Discord (Webhook URL). Toggle notify on connect or disconnect, run test messages, and save settings from one window.
Cloudflare Tunnel
Expose your C2 server through Cloudflare Zero Trust without port forwarding or firewall rules. Paste your tunnel token, click Start, and clients connect via Cloudflare's global network.
Webhook setup (Tools → 📡 Webhook Notifications)
- Telegram — enable, enter bot token & chat ID, test with one click
- Discord — enable, paste webhook URL (
discord.com/api/webhooks/...), test delivery - Events — choose 🟢 New Connection and/or 🔴 Disconnect independently
- Async delivery — notifications send on a background thread; the UI never blocks
Cloudflare Tunnel setup (Tools → ☁️ Cloudflare Tunnel Settings)
- No port forwarding — clients reach your server via Cloudflare's edge; no router or firewall changes needed
- Token-based auth — paste your Cloudflare Zero Trust tunnel token and save; credentials persist across restarts
- Start on startup — enable the checkbox to launch the tunnel automatically when the server starts
- Live log output — real-time cloudflared process output displayed directly in the settings window
Command Center. Full Control.
A beautiful JavaFX-powered dashboard to manage all your connections.
Multi-Client Management
Handle hundreds of simultaneous connections with real-time status monitoring, country flags, and OS detection.
Tabbed Interface
Each module opens in its own tab. Work with multiple modules on multiple clients simultaneously.
Task Automation
Schedule tasks to run automatically when clients connect. Execute modules on multiple clients at once.
Auto-Save Profiles
Save and load builder configurations. Share profiles across team members for consistent deployments.
Real-Time Notifications
Desktop notifications and optional sounds when clients connect or disconnect — toggle instantly from Tools → Notifications / Sounds.
Client Grouping
Organize clients by group, country, or OS. Apply bulk operations to entire groups at once.
Webhook Notifications
Telegram bot + Discord webhook integration with per-event toggles (connect/disconnect), built-in test buttons, and persistent saved settings.
Plugin Cache & CDN
Lazy plugin loading with disk cache, HTTPS mirror bundles, and hash-verified manifests — modules load only when opened.
Activity Log & Audit Trail
Searchable timeline of connections, disconnects, executions, transfers, and operator actions for quick review and troubleshooting.
Ready to Get Started?
Reach out through any of the channels below.