[Morpheus Loader]

Morpheus - is a new unique resident loader + reverse proxy for remote administration of Windows hosts (controlled via an external server) from industry veterans. The main focus is on regular updates, cleaning, and expanding functionality.

After installation, the agent is anchored in the system and registered on the server with a convenient control panel (C2), from where it requests tasks to be performed and uploads the results back to the cloud. Out of the box, monitoring, system management, credential harvesting, and network reconnaissance scanning operations are immediately available.

Detects: scan time, run time (kleenscan) (kleenscan): 0/26 FUD.


TECHNICAL INFORMATION:
Target platform: Windows 10/11 x64


Reverse proxy functionality (additional module allowing the use of IP bots and all the advantages that come with it):

• Displays a list of all proxies in real time
  


• Plots load graphs for each proxy
  


• Determines the country from which the connection originated
  


• Counts incoming and outgoing traffic
  


• Sends notifications if the proxy stops working
  


• Protects access to the panel with a password
  

Additional features: Works with RSA, XOR, UUID generation, debugger detection, file copying/hiding, etc.

INFORMATION FOR USERS:

• We operate on the MaaS model. In the current version, each client is hosted on a separate server, which eliminates a single point of failure.
  


• Mandatory encryption, without it the build is FUD. Encryption is necessary to protect against the build being leaked in its pure form.
  


• After your subscription ends, your bots will not disappear and will be available when you renew your plan.
  


• You can find the latest scans from scsnner.to/kleenscan in the posts below, as well as from support.
  


• For leaks to VT and other services, a lifetime ban with no money back, we will easily calculate the leaker's account by hash
  


• If you find bugs or other technical issues that prevent the program from working, write to support, we will consider each situation individually and add subscription days
  


• The loader does not work on CIS systems and will not work.
  
  

Prices:
-Beta 300/week:
1. Resident loader
2. CMD interactive shell
3. Reverse proxy

- Public $750/month:
1. Resident loader
2. CMD interactive shell
3. Reverse proxy

- Private $1500/month:
1. Resident loader
2. CMD interactive shell
3. Reverse proxy
4. Web RDP
5. Dedicated cleaning line
6. Individual work with functionality and code

Panel screens:



Contacts:
Telegram/Support
Start Contract

[DramaKing]

Just want to point out that people other than blackhats use VirusTotal.

[Qrentx]

Looks interesting with a very simple clean UI. GLWS

[SIM-4982069]

Looks cool, can you share some videos too?

[Morpheus Loader]

Just want to point out that people other than blackhats use VirusTotal.

We know about this bro

---

Looks interesting with a very simple clean UI. GLWS

We strive to serve our customers, with many useful updates ahead.

---

Looks cool, can you share some videos too?

You can see a video of the software in action on our Telegram channel.

---

---

Update 25.06 EN🇺🇸
for Vue + Tailwind CSS ( front bot update )
Fixed issues:

1. Missing dynamic classes
- Styles like bg-${color}-500 were not included in the final build, and were purchased when changing the day/night mode
2. Broken styles during hot reload
- Updating components in dev mode broke Tailwind
3. Conflicting scoped styles
- The @apply directive did not work inside <style scoped>
4. Incorrect style order
- Custom CSS unexpectedly overwrote Tailwind styles
5. Disappearing classes in conditional blocks
- Hidden-type classes were removed from the build when used in v-if
The update stabilizes the Vue 3 and Tailwind CSS combination, and also performs a full refactoring of the login form in the admin panel


Contacts:
Telegram/Support

[Morpheus Loader]

Update 27.06 EN🇺🇸
The beta version of the x64/x86 dropper has been implemented and tested.

1. Main features:
- Payload encryption (to protect against static analysis)
- Self-recovery (decryption and file writing to the system directory)
- PPID Spoofing (masquerading as a system child process)
- Stealth launch (CREATE_NO_WINDOW)

2. Key stages of operation:
A[Payload decryption] --> B[Writing to the system directory] -->
C[Searching for the PID of the target system process] -->
D[Replacing the parent process] -->
E[Stealth launch]

Contacts:
Telegram/Support

[Morpheus Loader]

Обновление 02.07 RU🇷🇺
Advanced Obfuscation for Scantime
Мы продолжаем улучшать наш продукт и следим за тендециями в мире малвари, в этом обновлении была проведена работа над клиентской частью(пейлоадом) а имено:
1.Мусорные инструкции – добавление бессмысленных команд, чтобы усложнить анализ.
2.Динамические вызовы API – программа не использует стандартные вызовы функций, а загружает их скрытно.
3.Полиморф – код меняет свою структуру каждый раз, чтобы сигнатуры антивирусов не срабатывали.

Update 02.07 EN🇺🇸
Advanced Obfuscation for Scantime
We continue to improve our product and monitor trends in the world of malware. In this update, we worked on the client side (payload), specifically:
1. Garbage instructions – adding meaningless commands to complicate analysis.
2. Dynamic API calls – the program does not use standard function calls, but loads them secretly.
3. Polymorphic – the code changes its structure each time so that antivirus signatures do not trigger.


Contacts:
Telegram/Support