Collection coverage
Built by operators who got tired of losing to $200 stealers.
red team tooling · est. on a Tuesday
We spent years reverse-engineering Lumma, Redline and Vidar for clients who paid us to catch up.
Every engagement ended the same way: the stealer won on Tuesday, the report landed on Friday.
So we stopped writing reports and built the weapon instead, then built the radar that tracks it.
Satan Core is the weapon and the radar in one stack. You stop chasing the stealer when you are the one flying it.
the Core team
no bots wrote this
Toolbox
Satan Core runs the operation: builder, implant, gate, decryption, and a queryable intelligence index for everything you harvest.
Every build ships with a unique SHA-256: per-build XOR key, randomised string table, junk-code injection and a random overlay. No two stubs share a signature: compile as often as you spread.
Indirect syscalls through an unhooked ntdll, AMSI and ETW patched in memory, anti-VM, anti-debug and anti-sandbox gates. Every build is scored locally against static signatures and ClamAV: the binary never leaves your server.
Passwords, cookies, autofill and credit cards from 13 Chromium browsers and the Firefox family. The implant extracts the DPAPI master key; the panel decrypts AES-GCM blobs server-side and shows you plaintext.
Discord tokens decrypted from leveldb, Telegram tdata, Steam ssfn, Teams, Zoom, Azure/MSAL caches, FileZilla credentials, WinSCP and PuTTY sessions, plus every saved WiFi password via netsh.
New infections land with country flag, Windows build and full system profile. Encrypted archives are HMAC-authenticated, AES-256-GCM on the wire, and parsed the moment they arrive.
How it works
Toggle the modules (browsers, wallets, tokens, WiFi, file grabber), pick your evasion profile, and hit compile. The server cross-compiles a polymorphic stub with its own AES key and runs a local AV check before you download anything.
unique SHA-256 · auto AV check
Drop the stub on the lab target. It sleeps, checks for sandboxes, unhooks ntdll, patches AMSI/ETW, then exfiltrates an encrypted archive over HTTPS with HMAC authentication. The panel lights up: flag, hostname, Windows build.
AES-256-GCM · HMAC gate
Passwords, cookies, cards and tokens are decrypted the second they land. Everything flows into the built-in intelligence index, where billions of records become one search bar away.
intelligence index · built in
Operator console
No raw zips to dig through. The gate authenticates and decrypts each archive, the panel shows the host, the loot and the plaintext, and indexes it all for later.
UNDETECTED
score 0/100 · ClamAV clean
1,204
server-side AES-GCM
312
Web Data parsed
58
netsh · all profiles
| Host | OS build | Geo | Loot decrypted | AV on target | Status | |
|---|---|---|---|---|---|---|
| MEGACORP-WS42 | Windows 11 Pro 23H2 | 🇩🇪 DE | 142 passwords · 3,841 cookies · 2 cards | Defender | online | Open loot |
| FIN-LT-0091 | Windows 10 Pro 22H2 | 🇫🇷 FR | 87 passwords · 12 Discord tokens | CrowdStrike | online | Open loot |
| DEV-UBUNTU-VM | Windows 11 Ent 24H2 | 🇧🇷 BR | WiFi ×4 · MetaMask · Steam ssfn | Defender | parsed | Open loot |
| CEO-SURFACE | Windows 11 Pro 24H2 | 🇺🇸 US | 231 passwords · Azure MSAL cache | Defender | parsed | Open loot |
Pricing
No tiers, no feature gates, no per-record nonsense. Every capability of the platform, one monthly crypto payment.
The full infostealer operations platform: builder, implant, panel. One plan, everything in.
Crypto payment via Plisio · renews month to month
Subscribe with crypto1 operator seat included
All prices exclude VAT. Public-sector, CERT and non-profit pricing available on request. Need an MSSP licence? Talk to our partner team.
FAQ
Still unsure? Our analysts run a free 30-minute exposure review with your team, no commitment.
Builder, gate, decryption, intelligence index. Satan Core runs the operation and remembers everything it finds.
Scoped, audited operations only: every action is logged.