Black Botnet | Source Leak

Advanced, modern Windows botnet with a hardened PHP panel built from scratch in VB.NET. No bloat, no .NET Core dependencies, runs clean on anything from Win7 to Win11

File Operations

• Upload from URL (supports direct download + curl fallback)
• Upload from Disk (chunked transfer, resume enabled)
• Encrypted file storage on victim (hidden ADS streams on NTFS)

DDOS Engine [7 Attack Vectors]

• TCP Flood (SYN + ACK amplification)
• UDP Flood (randomized payload, spoofed source)
• ARME (Amplified Reflection Memcached Exploit)
• Slowloris (async HTTP connection exhaustion)
• HTTPGet Flood (rotating user agents, proxy chain)
• POSTHttp Flood (form data randomization)
• Bandwidth Saturation (raw socket flood, multi-threaded)
• Start/Stop controls from panel with real-time packet count

Browser & Credential Harvesting

• Firefox Cookies  extracts sqlite DB, decrypts master key
• Chrome Cookies  same, but with v20+ encryption bypass (AES-GCM, no DPAPI dependency anymore)
• Discord Token  grabs from all 4 Discord build paths (Stable, PTB, Canary, Dev) + browser local storage
• Saved Passwords for:
  • Chrome (v80 to v130+)
  • Firefox (quantum + gecko)
  • NordVPN (credential cache + OAuth token)
  • FileZilla (XML sitemanager decryption)
  • Outlook (registry + COM extraction)
• Clipboard Stealer — watches for crypto addresses, regex replacement ready

System Manipulation

• Shell Commands: CMD + PowerShell with Bypass ExecutionPolicy
• Script Execution: VBS, JS, PS1, BAT — from panel or URL
• Custom Plugin Loader: DLL injection into system processes
• Computer Ops: Restart, Shutdown, Logout (delayed, instant, or scheduled)

Financial & Mining

• XMR Miner  pre-configured pool, configurable threads, stealth mode (only runs on idle)
• Bitcoin Wallet Stealer  scans for wallet.dat, Electrum, Exodus, Atomic, and 12/24-word seed phrases in text files

Miscellaneous

• MessageBox Spam  custom text, icon, buttons
• Webpage Opener  visible or hidden IE/Edge instance
• Spam Email Sender  SMTP with template engine
• Torrent Seeder  from disk or URL, magnet link support, ratio control
• Keylogger  offline buffer with clipboard capture, upload interval configurable
• Client Management  Uninstall, Move, Blacklist, Update, Kill (fully persistent removal)
• Screenshot Capture  multi-monitor support, PNG compression