CyberTrace Forensic Visual Audit Matrix // @CyberTrace20 & @wgkgi0x0 Watermark Verification

Threat ID	Dossier Profile	Attributed Evidence Matrix (1-to-1 Assets with @CyberTrace20 / @wgkgi0x0 Stamp)
TF-001 3 Assets	AsyncRAT RAT Dossier Whitepaper ↗	Builder UI STAMPED @CyberTrace20 \| @wgkgi0x0 OK AsyncRAT Client Payload Builder & Configurator `images/TF-001_asyncrat_real_01.png` 📐 779x359 px 💾 17.2 KB Surveillance Telemetry STAMPED @CyberTrace20 \| @wgkgi0x0 OK AsyncRAT Remote Desktop & Session Monitoring `images/TF-001_asyncrat_real_02.svg` 📐 1000x620 px 💾 9.9 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK AsyncRAT Technical Infection Chain & Architecture `images/TF-001_asyncrat_arch.svg` 📐 1000x620 px 💾 10.2 KB
TF-002 4 Assets	Dolphin X InfoStealer Dossier Whitepaper ↗	Builder UI STAMPED @CyberTrace20 \| @wgkgi0x0 OK Dolphin X AI Stealer Builder Interface `images/TF-002_dolphinx_real_01.png` 📐 960x640 px 💾 455.9 KB Exfiltration Channel STAMPED @CyberTrace20 \| @wgkgi0x0 OK Dolphin X Encrypted Telegram Exfiltration Feed `images/TF-002_dolphinx_real_02.png` 📐 960x640 px 💾 202.8 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK Dolphin X Technical Infection Chain & Architecture `images/TF-002_dolphinx_arch.svg` 📐 1000x620 px 💾 10.3 KB C2 Dashboard STAMPED @CyberTrace20 \| @wgkgi0x0 OK Dolphin X Central Web Telemetry Dashboard `images/dolphinx_05_dashboard.png` 📐 960x640 px 💾 265.0 KB
TF-003 3 Assets	Lumma Stealer InfoStealer Dossier Whitepaper ↗	Sandbox Execution STAMPED @CyberTrace20 \| @wgkgi0x0 OK Lumma Stealer Process Execution Graph `images/TF-003_lumma_real_01.png` 📐 1024x578 px 💾 332.0 KB C2 Communication STAMPED @CyberTrace20 \| @wgkgi0x0 OK LummaC2 Fast-Flux Network Handshake `images/TF-003_lumma_real_02.png` 📐 1024x523 px 💾 268.8 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK Lumma Stealer Technical Infection Chain & Architecture `images/TF-003_lumma_arch.svg` 📐 1000x620 px 💾 10.3 KB
TF-004 3 Assets	RedLine Stealer InfoStealer Dossier Whitepaper ↗	Process Injection STAMPED @CyberTrace20 \| @wgkgi0x0 OK RedLine Stealer Lua Bytecode Execution `images/TF-004_redline_real_01.png` 📐 1024x583 px 💾 399.2 KB Memory Extraction STAMPED @CyberTrace20 \| @wgkgi0x0 OK RedLine Browser Credential Vault Grabbing `images/TF-004_redline_real_02.png` 📐 1024x585 px 💾 337.4 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK RedLine Stealer Technical Infection Chain & Architecture `images/TF-004_redline_arch.svg` 📐 1000x620 px 💾 10.3 KB
TF-005 3 Assets	Vidar Stealer InfoStealer Dossier Whitepaper ↗	C2 Telemetry STAMPED @CyberTrace20 \| @wgkgi0x0 OK Vidar Dead-Drop Resolver Telemetry `images/TF-005_vidar_real_01.png` 📐 728x496 px 💾 113.3 KB Payload Execution STAMPED @CyberTrace20 \| @wgkgi0x0 OK Vidar Stealer SQLite Harvesting Routine `images/TF-005_vidar_real_02.png` 📐 1024x566 px 💾 416.1 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK Vidar Stealer Technical Infection Chain & Architecture `images/TF-005_vidar_arch.svg` 📐 1000x620 px 💾 10.3 KB
TF-006 3 Assets	Agent Tesla Spyware Dossier Whitepaper ↗	Execution Chain STAMPED @CyberTrace20 \| @wgkgi0x0 OK Agent Tesla Process Tree & Weaponized Document `images/TF-006_agenttesla_real_01.png` 📐 533x108 px 💾 18.5 KB Exfiltration Module STAMPED @CyberTrace20 \| @wgkgi0x0 OK Agent Tesla SMTP Exfiltration Routine `images/TF-006_agenttesla_real_02.png` 📐 520x428 px 💾 58.3 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK Agent Tesla Technical Infection Chain & Architecture `images/TF-006_agenttesla_arch.svg` 📐 1000x620 px 💾 10.3 KB
TF-007 3 Assets	Remcos RAT RAT Dossier Whitepaper ↗	Builder UI STAMPED @CyberTrace20 \| @wgkgi0x0 OK Remcos Professional Client Builder & Evasion Configurator `images/TF-007_remcos_real_01.png` 📐 852x415 px 💾 14.5 KB Operator Console STAMPED @CyberTrace20 \| @wgkgi0x0 OK Remcos Remote Administration Management Console `images/TF-007_remcos_real_02.svg` 📐 1000x620 px 💾 9.9 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK Remcos RAT Technical Infection Chain & Architecture `images/TF-007_remcos_arch.svg` 📐 1000x620 px 💾 10.2 KB
TF-008 3 Assets	XWorm RAT Dossier Whitepaper ↗	Builder UI STAMPED @CyberTrace20 \| @wgkgi0x0 OK XWorm Advanced Payload Builder Interface `images/TF-008_xworm_real_01.png` 📐 923x472 px 💾 26.0 KB Clipper Module STAMPED @CyberTrace20 \| @wgkgi0x0 OK XWorm Cryptocurrency Clipper Memory Routine `images/TF-008_xworm_real_02.svg` 📐 1000x620 px 💾 9.9 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK XWorm Technical Infection Chain & Architecture `images/TF-008_xworm_arch.svg` 📐 1000x620 px 💾 10.2 KB
TF-009 4 Assets	DarkGate Loader Dossier Whitepaper ↗	Infection Vector STAMPED @CyberTrace20 \| @wgkgi0x0 OK DarkGate Malicious MSI & AutoIt Lure `images/TF-009_darkgate_real_01.png` 📐 1675x797 px 💾 217.4 KB Config Extractor STAMPED @CyberTrace20 \| @wgkgi0x0 OK DarkGate Extracted C2 Configuration Parameters `images/TF-009_darkgate_real_02.png` 📐 1046x508 px 💾 1000.4 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK DarkGate Technical Infection Chain & Architecture `images/TF-009_darkgate_arch.svg` 📐 1000x620 px 💾 10.3 KB Network Packet Capture STAMPED @CyberTrace20 \| @wgkgi0x0 OK DarkGate HTTP C2 Request Header Analysis `images/darkgate_04_traffic.jpeg` 📐 2048x1263 px 💾 684.4 KB
TF-010 3 Assets	Rhadamanthys InfoStealer Dossier Whitepaper ↗	Builder UI STAMPED @CyberTrace20 \| @wgkgi0x0 OK Rhadamanthys Stealer Operator Panel Interface `images/TF-010_rhadamanthys_real_01.png` 📐 1792x1024 px 💾 2735.7 KB Memory VM STAMPED @CyberTrace20 \| @wgkgi0x0 OK Rhadamanthys Custom Virtual Machine Architecture `images/TF-010_rhadamanthys_real_02.svg` 📐 1000x620 px 💾 6.6 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK Rhadamanthys Technical Infection Chain & Architecture `images/TF-010_rhadamanthys_arch.svg` 📐 1000x620 px 💾 10.3 KB
TF-011 3 Assets	Stealc InfoStealer Dossier Whitepaper ↗	C2 Config STAMPED @CyberTrace20 \| @wgkgi0x0 OK Stealc C2 Communication Protocol Analysis `images/TF-011_stealc_real_01.png` 📐 845x1024 px 💾 239.6 KB Target Grabbing STAMPED @CyberTrace20 \| @wgkgi0x0 OK Stealc Modular Data Harvesting Pipeline `images/TF-011_stealc_real_02.png` 📐 740x449 px 💾 169.5 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK Stealc Technical Infection Chain & Architecture `images/TF-011_stealc_arch.svg` 📐 1000x620 px 💾 10.2 KB
TF-012 3 Assets	Havoc C2 C2 Framework Dossier Whitepaper ↗	Payload Generator STAMPED @CyberTrace20 \| @wgkgi0x0 OK Havoc Framework Demon Payload Configurator `images/TF-012_havoc_real_01.png` 📐 622x812 px 💾 46.8 KB Operator Console STAMPED @CyberTrace20 \| @wgkgi0x0 OK Havoc C2 Interactive Session Console `images/TF-012_havoc_real_02.png` 📐 1887x1159 px 💾 34.9 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK Havoc C2 Technical Infection Chain & Architecture `images/TF-012_havoc_arch.svg` 📐 1000x620 px 💾 10.3 KB
TF-013 3 Assets	Sliver C2 C2 Framework Dossier Whitepaper ↗	Operator Console STAMPED @CyberTrace20 \| @wgkgi0x0 OK Sliver C2 Interactive Command Console `images/TF-013_sliver_real_01.png` 📐 799x260 px 💾 272.7 KB Injection Routine STAMPED @CyberTrace20 \| @wgkgi0x0 OK Sliver Process Injection & Evasion Engine `images/TF-013_sliver_real_02.svg` 📐 1000x620 px 💾 7.4 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK Sliver C2 Technical Infection Chain & Architecture `images/TF-013_sliver_arch.svg` 📐 1000x620 px 💾 10.3 KB
TF-014 3 Assets	Mythic C2 C2 Framework Dossier Whitepaper ↗	Operator Dashboard STAMPED @CyberTrace20 \| @wgkgi0x0 OK Mythic C2 Operation Management Dashboard `images/TF-014_mythic_real_01.svg` 📐 1000x620 px 💾 9.9 KB Payload Architecture STAMPED @CyberTrace20 \| @wgkgi0x0 OK Mythic Modular Agent Communication Engine `images/TF-014_mythic_real_02.svg` 📐 1000x620 px 💾 8.4 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK Mythic C2 Technical Infection Chain & Architecture `images/TF-014_mythic_arch.svg` 📐 1000x620 px 💾 10.3 KB
TF-015 3 Assets	QuasarRAT RAT Dossier Whitepaper ↗	Builder UI STAMPED @CyberTrace20 \| @wgkgi0x0 OK QuasarRAT Open-Source Builder & Certificate Generator `images/TF-015_quasarrat_real_01.png` 📐 1030x485 px 💾 15.7 KB Surveillance Module STAMPED @CyberTrace20 \| @wgkgi0x0 OK QuasarRAT Surveillance & File Manager Interface `images/TF-015_quasarrat_real_02.svg` 📐 1000x620 px 💾 9.9 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK QuasarRAT Technical Infection Chain & Architecture `images/TF-015_quasarrat_arch.svg` 📐 1000x620 px 💾 10.2 KB
TF-016 3 Assets	Warzone RAT / Ave Maria RAT Dossier Whitepaper ↗	Builder UI STAMPED @CyberTrace20 \| @wgkgi0x0 OK Warzone RAT (Ave Maria) Builder Interface `images/TF-016_warzone_real_01.png` 📐 1300x578 px 💾 20.9 KB Privilege Escalation STAMPED @CyberTrace20 \| @wgkgi0x0 OK Warzone RAT AveMaria Memory Persistence Engine `images/TF-016_warzone_real_02.svg` 📐 1000x620 px 💾 9.9 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK Warzone RAT / Ave Maria Technical Infection Chain & Architecture `images/TF-016_warzone_arch.svg` 📐 1000x620 px 💾 10.2 KB
TF-017 3 Assets	GuLoader / CloudEyE Loader Dossier Whitepaper ↗	Execution Chain STAMPED @CyberTrace20 \| @wgkgi0x0 OK GuLoader (CloudEyE) Multi-Stage Shellcode Chain `images/TF-017_guloader_real_01.jpg` 📐 841x533 px 💾 88.1 KB Anti-Analysis Routine STAMPED @CyberTrace20 \| @wgkgi0x0 OK GuLoader Vectored Exception Handling (VEH) Check `images/TF-017_guloader_real_02.png` 📐 1024x217 px 💾 95.6 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK GuLoader / CloudEyE Technical Infection Chain & Architecture `images/TF-017_guloader_arch.svg` 📐 1000x620 px 💾 10.3 KB
TF-018 3 Assets	Pikabot Loader Dossier Whitepaper ↗	Loader Routine STAMPED @CyberTrace20 \| @wgkgi0x0 OK Pikabot Modular Core Loader Architecture `images/TF-018_pikabot_real_01.svg` 📐 1000x620 px 💾 9.9 KB C2 Protocol STAMPED @CyberTrace20 \| @wgkgi0x0 OK Pikabot Network Beacon & RC4 Decryption `images/TF-018_pikabot_real_02.svg` 📐 1000x620 px 💾 8.3 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK Pikabot Technical Infection Chain & Architecture `images/TF-018_pikabot_arch.svg` 📐 1000x620 px 💾 10.2 KB
TF-019 3 Assets	Qakbot / QBot Loader Dossier Whitepaper ↗	Banking Module STAMPED @CyberTrace20 \| @wgkgi0x0 OK Qakbot (QBot) Core Web-Inject & Delivery Engine `images/TF-019_qakbot_real_01.svg` 📐 1000x620 px 💾 9.9 KB Process Hollowing STAMPED @CyberTrace20 \| @wgkgi0x0 OK Qakbot Process Replacement in wermgr.exe `images/TF-019_qakbot_real_02.svg` 📐 1000x620 px 💾 8.1 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK Qakbot / QBot Technical Infection Chain & Architecture `images/TF-019_qakbot_arch.svg` 📐 1000x620 px 💾 10.3 KB
TF-020 3 Assets	Emotet Botnet Dossier Whitepaper ↗	Botnet Architecture STAMPED @CyberTrace20 \| @wgkgi0x0 OK Emotet Epoch Tier-1 Command Infrastructure `images/TF-020_emotet_real_01.svg` 📐 1000x620 px 💾 9.9 KB Payload Execution STAMPED @CyberTrace20 \| @wgkgi0x0 OK Emotet Encrypted DLL Loader Disassembly `images/TF-020_emotet_real_02.svg` 📐 1000x620 px 💾 8.7 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK Emotet Technical Infection Chain & Architecture `images/TF-020_emotet_arch.svg` 📐 1000x620 px 💾 10.2 KB
TF-021 3 Assets	LockBit 3.0 Ransomware Dossier Whitepaper ↗	Ransomware Execution STAMPED @CyberTrace20 \| @wgkgi0x0 OK LockBit 3.0 (Black) Execution Process Tree `images/TF-021_lockbit_real_01.png` 📐 1024x614 px 💾 379.3 KB Leak Infrastructure STAMPED @CyberTrace20 \| @wgkgi0x0 OK LockBit Darknet Tor Extortion Portal `images/TF-021_lockbit_real_02.png` 📐 1024x559 px 💾 337.5 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK LockBit 3.0 Technical Infection Chain & Architecture `images/TF-021_lockbit_arch.svg` 📐 1000x620 px 💾 10.3 KB
TF-022 3 Assets	BlackCat / ALPHV Ransomware Dossier Whitepaper ↗	Execution Flags STAMPED @CyberTrace20 \| @wgkgi0x0 OK BlackCat (ALPHV) Rust CLI Execution Parameters `images/TF-022_blackcat_real_01.png` 📐 836x454 px 💾 46.8 KB Ransom Artifact STAMPED @CyberTrace20 \| @wgkgi0x0 OK BlackCat Recover-My-Files Note & Tor Gateway `images/TF-022_blackcat_real_02.svg` 📐 1000x620 px 💾 3.5 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK BlackCat / ALPHV Technical Infection Chain & Architecture `images/TF-022_blackcat_arch.svg` 📐 1000x620 px 💾 10.3 KB
TF-023 3 Assets	Akira Ransomware Dossier Whitepaper ↗	Extortion Engine STAMPED @CyberTrace20 \| @wgkgi0x0 OK Akira Ransomware Enterprise Encryption Routine `images/TF-023_akira_real_01.svg` 📐 1000x620 px 💾 9.9 KB Disassembly Analysis STAMPED @CyberTrace20 \| @wgkgi0x0 OK Akira Volume Shadow Deletion & Service Killer `images/TF-023_akira_real_02.svg` 📐 1000x620 px 💾 8.1 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK Akira Technical Infection Chain & Architecture `images/TF-023_akira_arch.svg` 📐 1000x620 px 💾 10.2 KB
TF-024 3 Assets	Medusa Ransomware Dossier Whitepaper ↗	Extortion Portal STAMPED @CyberTrace20 \| @wgkgi0x0 OK Medusa Ransomware Blog & Victim Negotiation Console `images/TF-024_medusa_real_01.svg` 📐 1000x620 px 💾 9.9 KB Disassembly Analysis STAMPED @CyberTrace20 \| @wgkgi0x0 OK Medusa Service Termination & Process Sweeper `images/TF-024_medusa_real_02.svg` 📐 1000x620 px 💾 8.1 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK Medusa Technical Infection Chain & Architecture `images/TF-024_medusa_arch.svg` 📐 1000x620 px 💾 10.3 KB
TF-025 3 Assets	Phobos / 8Base Ransomware Dossier Whitepaper ↗	Decryptor Utility STAMPED @CyberTrace20 \| @wgkgi0x0 OK Phobos / 8Base Ransomware Execution & Recovery Stub `images/TF-025_phobos_real_01.svg` 📐 1000x620 px 💾 10.0 KB Network Telemetry STAMPED @CyberTrace20 \| @wgkgi0x0 OK Phobos Command and Control Beaconing `images/TF-025_phobos_real_02.svg` 📐 1000x620 px 💾 7.2 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK Phobos / 8Base Technical Infection Chain & Architecture `images/TF-025_phobos_arch.svg` 📐 1000x620 px 💾 10.3 KB
TF-026 3 Assets	Formbook / XLoader InfoStealer Dossier Whitepaper ↗	Injection Scheme STAMPED @CyberTrace20 \| @wgkgi0x0 OK Formbook / XLoader Multi-Level Injection Chain `images/TF-026_formbook_real_01.png` 📐 793x713 px 💾 23.3 KB C2 Decryption STAMPED @CyberTrace20 \| @wgkgi0x0 OK Formbook Traffic Encryption & Decryption Engine `images/TF-026_formbook_real_02.png` 📐 574x480 px 💾 55.1 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK Formbook / XLoader Technical Infection Chain & Architecture `images/TF-026_formbook_arch.svg` 📐 1000x620 px 💾 10.3 KB
TF-027 3 Assets	Bumblebee Loader Dossier Whitepaper ↗	Stager Routine STAMPED @CyberTrace20 \| @wgkgi0x0 OK Bumblebee Modular Loader Staging Routine `images/TF-027_bumblebee_real_01.svg` 📐 1000x620 px 💾 9.9 KB Disassembly Analysis STAMPED @CyberTrace20 \| @wgkgi0x0 OK Bumblebee WebSocket C2 Handshake Routine `images/TF-027_bumblebee_real_02.svg` 📐 1000x620 px 💾 7.7 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK Bumblebee Technical Infection Chain & Architecture `images/TF-027_bumblebee_arch.svg` 📐 1000x620 px 💾 10.2 KB
TF-028 3 Assets	IcedID (BokBot) Loader Dossier Whitepaper ↗	Steganography STAMPED @CyberTrace20 \| @wgkgi0x0 OK IcedID (BokBot) Steganographic PNG Loader `images/TF-028_icedid_real_01.svg` 📐 1000x620 px 💾 9.9 KB Banking Module STAMPED @CyberTrace20 \| @wgkgi0x0 OK IcedID Process Injection into svchost.exe `images/TF-028_icedid_real_02.svg` 📐 1000x620 px 💾 8.0 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK IcedID (BokBot) Technical Infection Chain & Architecture `images/TF-028_icedid_arch.svg` 📐 1000x620 px 💾 10.2 KB
TF-029 3 Assets	DanaBot InfoStealer Dossier Whitepaper ↗	Operator Panel STAMPED @CyberTrace20 \| @wgkgi0x0 OK DanaBot Banking Trojan Control Interface `images/TF-029_danabot_real_01.svg` 📐 1000x620 px 💾 9.9 KB Disassembly Analysis STAMPED @CyberTrace20 \| @wgkgi0x0 OK DanaBot Modular Architecture & Plugin Loader `images/TF-029_danabot_real_02.svg` 📐 1000x620 px 💾 6.0 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK DanaBot Technical Infection Chain & Architecture `images/TF-029_danabot_arch.svg` 📐 1000x620 px 💾 10.2 KB
TF-030 3 Assets	SmokeLoader Loader Dossier Whitepaper ↗	Plugin Engine STAMPED @CyberTrace20 \| @wgkgi0x0 OK SmokeLoader Modular Plugin System `images/TF-030_smokeloader_real_01.svg` 📐 1000x620 px 💾 10.0 KB Anti-Analysis STAMPED @CyberTrace20 \| @wgkgi0x0 OK SmokeLoader API Hashing & VM Detection `images/TF-030_smokeloader_real_02.svg` 📐 1000x620 px 💾 7.8 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK SmokeLoader Technical Infection Chain & Architecture `images/TF-030_smokeloader_arch.svg` 📐 1000x620 px 💾 10.2 KB
TF-031 3 Assets	Cobalt Strike C2 Framework Dossier Whitepaper ↗	Listeners UI STAMPED @CyberTrace20 \| @wgkgi0x0 OK Cobalt Strike Listener Management & Beacon Console `images/TF-031_cobaltstrike_real_01.png` 📐 440x626 px 💾 52.6 KB Beacon Architecture STAMPED @CyberTrace20 \| @wgkgi0x0 OK Cobalt Strike In-Memory Beacon Reflection Engine `images/TF-031_cobaltstrike_real_02.svg` 📐 1000x620 px 💾 10.0 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK Cobalt Strike Technical Infection Chain & Architecture `images/TF-031_cobaltstrike_arch.svg` 📐 1000x620 px 💾 10.3 KB
TF-032 3 Assets	Brute Ratel C4 C2 Framework Dossier Whitepaper ↗	Payload Execution STAMPED @CyberTrace20 \| @wgkgi0x0 OK Brute Ratel C4 Badger Execution Graph `images/TF-032_bruteratel_real_01.png` 📐 989x54 px 💾 17.6 KB Syscall Engine STAMPED @CyberTrace20 \| @wgkgi0x0 OK Brute Ratel Indirect Syscall Execution Routine `images/TF-032_bruteratel_real_02.png` 📐 684x313 px 💾 46.5 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK Brute Ratel C4 Technical Infection Chain & Architecture `images/TF-032_bruteratel_arch.svg` 📐 1000x620 px 💾 10.3 KB
TF-033 3 Assets	NetSupport RAT RAT Dossier Whitepaper ↗	Gateway Config STAMPED @CyberTrace20 \| @wgkgi0x0 OK NetSupport RAT Gateway Configuration & Deployment `images/TF-033_netsupport_real_01.svg` 📐 1000x620 px 💾 10.0 KB Disassembly Analysis STAMPED @CyberTrace20 \| @wgkgi0x0 OK NetSupport RAT Screen Capture & Keystroke Monitor `images/TF-033_netsupport_real_02.svg` 📐 1000x620 px 💾 6.0 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK NetSupport RAT Technical Infection Chain & Architecture `images/TF-033_netsupport_arch.svg` 📐 1000x620 px 💾 10.2 KB
TF-034 3 Assets	NjRAT / Bladabindi RAT Dossier Whitepaper ↗	Builder UI STAMPED @CyberTrace20 \| @wgkgi0x0 OK NjRAT (Bladabindi) Golden Edition Builder Interface `images/TF-034_njrat_real_01.png` 📐 846x400 px 💾 17.8 KB Operator Console STAMPED @CyberTrace20 \| @wgkgi0x0 OK NjRAT Victim Management & Webcam Surveillance Console `images/TF-034_njrat_real_02.svg` 📐 1000x620 px 💾 9.9 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK NjRAT / Bladabindi Technical Infection Chain & Architecture `images/TF-034_njrat_arch.svg` 📐 1000x620 px 💾 10.2 KB
TF-035 3 Assets	DCRat (DarkCrystal) RAT Dossier Whitepaper ↗	Builder UI STAMPED @CyberTrace20 \| @wgkgi0x0 OK DCRat (DarkCrystal) Studio & Plugin Builder `images/TF-035_dcrat_real_01.png` 📐 875x485 px 💾 19.2 KB Operator Console STAMPED @CyberTrace20 \| @wgkgi0x0 OK DCRat Botnet Administration Dashboard `images/TF-035_dcrat_real_02.svg` 📐 1000x620 px 💾 9.9 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK DCRat (DarkCrystal) Technical Infection Chain & Architecture `images/TF-035_dcrat_arch.svg` 📐 1000x620 px 💾 10.2 KB
TF-036 3 Assets	PureCrypter / PureLogs Crypter Dossier Whitepaper ↗	Obfuscation Engine STAMPED @CyberTrace20 \| @wgkgi0x0 OK PureCrypter Multi-Layer Obfuscation Architecture `images/TF-036_purecrypter_real_01.svg` 📐 1000x620 px 💾 10.0 KB Disassembly Analysis STAMPED @CyberTrace20 \| @wgkgi0x0 OK PureCrypter In-Memory Payload Decryption `images/TF-036_purecrypter_real_02.svg` 📐 1000x620 px 💾 6.0 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK PureCrypter / PureLogs Technical Infection Chain & Architecture `images/TF-036_purecrypter_arch.svg` 📐 1000x620 px 💾 10.2 KB
TF-037 3 Assets	PrivateLoader Loader Dossier Whitepaper ↗	Distribution Network STAMPED @CyberTrace20 \| @wgkgi0x0 OK PrivateLoader Pay-Per-Install Distribution Topology `images/TF-037_privateloader_real_01.jpg` 📐 841x533 px 💾 120.2 KB Payload Decryption STAMPED @CyberTrace20 \| @wgkgi0x0 OK PrivateLoader Payload Decryption & Execution Trace `images/TF-037_privateloader_real_02.png` 📐 698x121 px 💾 15.5 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK PrivateLoader Technical Infection Chain & Architecture `images/TF-037_privateloader_arch.svg` 📐 1000x620 px 💾 10.2 KB
TF-038 3 Assets	SystemBC Botnet Dossier Whitepaper ↗	Proxy Engine STAMPED @CyberTrace20 \| @wgkgi0x0 OK SystemBC SOCKS5 Tor Proxy Tunnel Architecture `images/TF-038_systembc_real_01.svg` 📐 1000x620 px 💾 10.0 KB Network Telemetry STAMPED @CyberTrace20 \| @wgkgi0x0 OK SystemBC Beacon Traffic & Command Protocol `images/TF-038_systembc_real_02.svg` 📐 1000x620 px 💾 7.8 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK SystemBC Technical Infection Chain & Architecture `images/TF-038_systembc_arch.svg` 📐 1000x620 px 💾 10.2 KB
TF-039 3 Assets	Mirai & Variants Botnet Dossier Whitepaper ↗	Telnet Scanner STAMPED @CyberTrace20 \| @wgkgi0x0 OK Mirai IoT Telnet Brute-Force Scanner Routine `images/TF-039_mirai_real_01.svg` 📐 1000x620 px 💾 9.9 KB DDoS Engine STAMPED @CyberTrace20 \| @wgkgi0x0 OK Mirai SYN and UDP Flood Attack Engine `images/TF-039_mirai_real_02.svg` 📐 1000x620 px 💾 8.0 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK Mirai & Variants Technical Infection Chain & Architecture `images/TF-039_mirai_arch.svg` 📐 1000x620 px 💾 10.3 KB
TF-040 3 Assets	Mozi Botnet Botnet Dossier Whitepaper ↗	P2P Network STAMPED @CyberTrace20 \| @wgkgi0x0 OK Mozi Botnet DHT P2P Coordination Protocol `images/TF-040_mozi_real_01.svg` 📐 1000x620 px 💾 9.9 KB Exploit Module STAMPED @CyberTrace20 \| @wgkgi0x0 OK Mozi IoT Zero-Day Exploit Propagation Module `images/TF-040_mozi_real_02.svg` 📐 1000x620 px 💾 7.8 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK Mozi Botnet Technical Infection Chain & Architecture `images/TF-040_mozi_arch.svg` 📐 1000x620 px 💾 10.2 KB
TF-041 3 Assets	Meduza Stealer InfoStealer Dossier Whitepaper ↗	Collector Dashboard STAMPED @CyberTrace20 \| @wgkgi0x0 OK Meduza Stealer Web Administration Dashboard `images/TF-041_meduza_real_01.svg` 📐 1000x620 px 💾 10.0 KB Network Telemetry STAMPED @CyberTrace20 \| @wgkgi0x0 OK Meduza Stealer C2 Exfiltration Handshake `images/TF-041_meduza_real_02.svg` 📐 1000x620 px 💾 7.3 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK Meduza Stealer Technical Infection Chain & Architecture `images/TF-041_meduza_arch.svg` 📐 1000x620 px 💾 10.2 KB
TF-042 3 Assets	RisePro InfoStealer Dossier Whitepaper ↗	Network Protocol STAMPED @CyberTrace20 \| @wgkgi0x0 OK RisePro Stealer Network Communication & Encryption `images/TF-042_risepro_real_01.webp` 📐 800x600 px 💾 49.7 KB Exfiltration Packet STAMPED @CyberTrace20 \| @wgkgi0x0 OK RisePro Credential Archive Assembly & Dispatch `images/TF-042_risepro_real_02.webp` 📐 800x600 px 💾 32.5 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK RisePro Technical Infection Chain & Architecture `images/TF-042_risepro_arch.svg` 📐 1000x620 px 💾 10.2 KB
TF-043 3 Assets	BunnyLoader Loader Dossier Whitepaper ↗	Modular Core STAMPED @CyberTrace20 \| @wgkgi0x0 OK BunnyLoader 3.0 Modular Control Interface `images/TF-043_bunnyloader_real_01.svg` 📐 1000x620 px 💾 10.0 KB Network Telemetry STAMPED @CyberTrace20 \| @wgkgi0x0 OK BunnyLoader Tasking & Secondary Drop Telemetry `images/TF-043_bunnyloader_real_02.svg` 📐 1000x620 px 💾 7.2 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK BunnyLoader Technical Infection Chain & Architecture `images/TF-043_bunnyloader_arch.svg` 📐 1000x620 px 💾 10.2 KB
TF-044 3 Assets	Latrodectus Loader Dossier Whitepaper ↗	Execution Pipeline STAMPED @CyberTrace20 \| @wgkgi0x0 OK Latrodectus High-Stealth Loader Execution Pipeline `images/TF-044_latrodectus_real_01.png` 📐 989x54 px 💾 17.6 KB C2 Telemetry STAMPED @CyberTrace20 \| @wgkgi0x0 OK Latrodectus FNV-1a Hashing & C2 Beacon Protocol `images/TF-044_latrodectus_real_02.svg` 📐 1000x620 px 💾 7.2 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK Latrodectus Technical Infection Chain & Architecture `images/TF-044_latrodectus_arch.svg` 📐 1000x620 px 💾 10.2 KB
TF-045 3 Assets	StrelaStealer InfoStealer Dossier Whitepaper ↗	Mail Harvester STAMPED @CyberTrace20 \| @wgkgi0x0 OK StrelaStealer Outlook & Thunderbird Credential Harvester `images/TF-045_strelastealer_real_01.svg` 📐 1000x620 px 💾 10.0 KB Network Telemetry STAMPED @CyberTrace20 \| @wgkgi0x0 OK StrelaStealer C2 Exfiltration Traffic `images/TF-045_strelastealer_real_02.svg` 📐 1000x620 px 💾 7.3 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK StrelaStealer Technical Infection Chain & Architecture `images/TF-045_strelastealer_arch.svg` 📐 1000x620 px 💾 10.3 KB
TF-046 3 Assets	HijackLoader Loader Dossier Whitepaper ↗	Chunk Extraction STAMPED @CyberTrace20 \| @wgkgi0x0 OK HijackLoader (IDAT Loader) Image Chunk Extraction `images/TF-046_hijackloader_real_01.png` 📐 1024x566 px 💾 454.3 KB Process Hollowing STAMPED @CyberTrace20 \| @wgkgi0x0 OK HijackLoader Process Injection into Clean Windows Binary `images/TF-046_hijackloader_real_02.svg` 📐 1000x620 px 💾 7.6 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK HijackLoader Technical Infection Chain & Architecture `images/TF-046_hijackloader_arch.svg` 📐 1000x620 px 💾 10.2 KB
TF-047 3 Assets	RustBucket Loader Dossier Whitepaper ↗	macOS Lure STAMPED @CyberTrace20 \| @wgkgi0x0 OK RustBucket macOS PDF Viewer Lure & Execution `images/TF-047_rustbucket_real_01.svg` 📐 1000x620 px 💾 10.0 KB Network Telemetry STAMPED @CyberTrace20 \| @wgkgi0x0 OK RustBucket Multi-Stage C2 Domain Resolution `images/TF-047_rustbucket_real_02.svg` 📐 1000x620 px 💾 7.8 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK RustBucket Technical Infection Chain & Architecture `images/TF-047_rustbucket_arch.svg` 📐 1000x620 px 💾 10.2 KB
TF-048 3 Assets	Atomic Stealer (AMOS) InfoStealer Dossier Whitepaper ↗	ClickFix Lure STAMPED @CyberTrace20 \| @wgkgi0x0 OK Atomic Stealer (AMOS) macOS ClickFix Delivery Lure `images/TF-048_atomic_real_01.png` 📐 1024x577 px 💾 369.0 KB C2 Exfiltration STAMPED @CyberTrace20 \| @wgkgi0x0 OK Atomic Stealer Telegram & HTTP Exfiltration Traffic `images/TF-048_atomic_real_02.png` 📐 869x476 px 💾 169.5 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK Atomic Stealer (AMOS) Technical Infection Chain & Architecture `images/TF-048_atomic_arch.svg` 📐 1000x620 px 💾 10.3 KB
TF-049 3 Assets	ShadowPad C2 Framework Dossier Whitepaper ↗	Plugin Engine STAMPED @CyberTrace20 \| @wgkgi0x0 OK ShadowPad Modular Backdoor Architecture `images/TF-049_shadowpad_real_01.svg` 📐 1000x620 px 💾 10.0 KB Disassembly Analysis STAMPED @CyberTrace20 \| @wgkgi0x0 OK ShadowPad Root Loader & DLL Sideloading Routine `images/TF-049_shadowpad_real_02.svg` 📐 1000x620 px 💾 6.0 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK ShadowPad Technical Infection Chain & Architecture `images/TF-049_shadowpad_arch.svg` 📐 1000x620 px 💾 10.2 KB
TF-050 3 Assets	PlugX / Korplug RAT Dossier Whitepaper ↗	Builder UI STAMPED @CyberTrace20 \| @wgkgi0x0 OK PlugX (Korplug) Payload Builder & Configurator `images/TF-050_plugx_real_01.png` 📐 752x553 px 💾 21.5 KB DLL Sideloading STAMPED @CyberTrace20 \| @wgkgi0x0 OK PlugX DLL Search-Order Hijacking Routine `images/TF-050_plugx_real_02.svg` 📐 1000x620 px 💾 9.9 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK PlugX / Korplug Technical Infection Chain & Architecture `images/TF-050_plugx_arch.svg` 📐 1000x620 px 💾 10.2 KB
TF-051 3 Assets	CraxsRAT RAT Dossier Whitepaper ↗	Builder UI STAMPED @CyberTrace20 \| @wgkgi0x0 OK CraxsRAT v7.6 Operator Dashboard & Listener Console `images/TF-051_craxsrat_real_01.png` 📐 1205x678 px 💾 138.4 KB Builder UI STAMPED @CyberTrace20 \| @wgkgi0x0 OK CraxsRAT APK Builder Features & Obfuscation Toggles `images/TF-051_craxsrat_real_02.png` 📐 481x321 px 💾 37.1 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK CraxsRAT Technical Infection Chain & Architecture `images/TF-051_craxsrat_arch.svg` 📐 1000x620 px 💾 4.2 KB
TF-052 3 Assets	SpyNote RAT Dossier Whitepaper ↗	Builder UI STAMPED @CyberTrace20 \| @wgkgi0x0 OK SpyNote v6.4 Operator Controller & Client Table `images/TF-052_spynote_real_01.png` 📐 866x451 px 💾 17.5 KB Builder UI STAMPED @CyberTrace20 \| @wgkgi0x0 OK SpyMax v4.0 / SpyNote Administrator Builder Console `images/TF-052_spynote_real_02.png` 📐 820x379 px 💾 21.0 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK SpyNote Technical Infection Chain & Architecture `images/TF-052_spynote_arch.svg` 📐 1000x620 px 💾 4.2 KB
TF-053 3 Assets	EagleSpy RAT Dossier Whitepaper ↗	Builder UI STAMPED @CyberTrace20 \| @wgkgi0x0 OK EagleSpy V4 Operator Console & Crypto Grabber Panel `images/TF-053_eaglespy_real_01.png` 📐 1339x806 px 💾 128.7 KB Builder UI STAMPED @CyberTrace20 \| @wgkgi0x0 OK EagleSpy Ultimate v3.0 APK Builder & Device Monitor `images/TF-053_eaglespy_real_02.png` 📐 1255x762 px 💾 84.8 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK EagleSpy Technical Infection Chain & Architecture `images/TF-053_eaglespy_arch.svg` 📐 1000x620 px 💾 4.2 KB
TF-054 3 Assets	VenomRAT RAT Dossier Whitepaper ↗	Builder UI STAMPED @CyberTrace20 \| @wgkgi0x0 OK VenomRAT + HVNC v6.1.0 Operator Console & Task Manager `images/TF-054_venomrat_real_01.png` 📐 1360x769 px 💾 40.8 KB Builder UI STAMPED @CyberTrace20 \| @wgkgi0x0 OK VenomRAT HVNC Panel & Builder Toolbar `images/TF-054_venomrat_real_02.png` 📐 1560x787 px 💾 45.9 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK VenomRAT Technical Infection Chain & Architecture `images/TF-054_venomrat_arch.svg` 📐 1000x620 px 💾 4.2 KB
TF-055 3 Assets	BitRAT RAT Dossier Whitepaper ↗	Builder UI STAMPED @CyberTrace20 \| @wgkgi0x0 OK BitRAT Operator Console & Endpoint Telemetry Grid `images/TF-055_bitrat_real_01.png` 📐 1460x537 px 💾 27.5 KB Forensic Disassembly STAMPED @CyberTrace20 \| @wgkgi0x0 OK BitRAT Native C++ IDA Pro 8.4 Disassembly (IUPnPNAT & termsrv.dll Patch) `images/TF-055_bitrat_real_02.png` 📐 1040x580 px 💾 102.6 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK BitRAT Technical Infection Chain & Architecture `images/TF-055_bitrat_arch.svg` 📐 1000x620 px 💾 4.2 KB
TF-056 3 Assets	RevengeRAT RAT Dossier Whitepaper ↗	Builder UI STAMPED @CyberTrace20 \| @wgkgi0x0 OK RevengeRAT v0.3 Operator Controller & Client Builder `images/TF-056_revengerat_real_01.png` 📐 1047x607 px 💾 30.8 KB Forensic Disassembly STAMPED @CyberTrace20 \| @wgkgi0x0 OK RevengeRAT Decompiled C# Client & IdGenerator Classes (dnSpy) `images/TF-056_revengerat_real_02.png` 📐 2516x1120 px 💾 543.4 KB Architecture Schematic STAMPED @CyberTrace20 \| @wgkgi0x0 OK RevengeRAT Technical Infection Chain & Architecture `images/TF-056_revengerat_arch.svg` 📐 1000x620 px 💾 4.2 KB