Brief Instructions
Main objects for interaction:

- Graphical console [front_gui] (this web console) – used to manage persistent connections on hosts, assign job queues, launch modules for interactive work, etc.
- Console utility [bc] – used for working with interactive modules via the classic command line.
- PowerShell scripts [ps_scripts] – used to install persistence on hosts, launch certain modules without installing persistence, and more.

[front_gui]
Main Page
Welcome message and instructions.

Nodes Page
Main page. This is where persistent connections (Nodes) are managed.
A persistent connection is installed on a target host by running the script RunSchedulerTask.ps1. Each connection has a unique hash (Hash). By default, the connection checks in via HTTPS every 1–1.5 hours for a new job queue. On the first check-in, it downloads a fresh core module with basic functionality. If a connection checks in from a previously unknown IP address, it must be verified in the list of persistent connections within 5 minutes; otherwise, it will not download the core module and will wait for the next check-in.

Statistics Block
General statistics for persistent connections:

- Alive nodes (last check-in less than 2 hours ago)
- Offline nodes (last check-in between 2 and 40 hours ago)
- Dead nodes (last check-in more than 40 hours ago)
- New nodes 24h (check-ins from previously unknown connections within the last 24 hours)
- New nodes 72h (check-ins from previously unknown connections within the last 72 hours)
- Unverified nodes (check-ins from unverified hosts)

Clicking on one of these options will filter the table to show clients in the selected category.
Below this section, the current status of servers (responding/not responding) is displayed by type:

- Command server – main C&C servers receiving check-ins.
- Shell server – servers handling interactive shells (SHELL module).
- Proxifier server – reverse proxy servers used by SOCKS/VNC/FTP modules.

Task Assignments Block
Adding tasks (Task) to selected persistent connections. Tasks can be assigned via the Assign button to either selected connections in the node list (Assign to selected in Node list) or to a predefined group (Assign to group...). IMPORTANT! Tasks are queued and executed in chronological order upon the next check-in. The table below shows only the latest task; the task queue for a specific host can be viewed under the Tasks tab on its dedicated page.

Types of tasks:

- Set group – Assign a selected connection to a group (an existing group can be selected or a new one created).
- Gather information – Collect general system information from the host, such as OS version, architecture, and network configuration. The gathered information is available on the specific node’s page after task completion.
- Run CMD command – Execute an arbitrary command in cmd.exe; the output will be available in the task details on the node list or the specific node’s task history.
  - Parameters: <command string>
- Upload & run SHELL module – Deploy the SHELL module and launch a reverse shell to a predefined address. General shell data is available on the Shell nodes page. Further interaction is handled via the console utility [bc].
- Upload & run SOCKS module – Deploy the SOCKS module and launch a reverse SOCKS5 connection to a predefined address.
  - Parameters:
    - <proxy server address>
    - <proxy server port>
    - <password for connection>
- Sleep ONE TIME – Delay check-in by a specified time instead of using the default interval.
  - Parameters: <interval in seconds>
- Set interval time – Set a new check-in interval of ±25% instead of the default interval.
  - Parameters: <interval in seconds>
- Restart & reload core – Unload the current core module and download a new one.
- Stop until reboot – Disable the persistent connection until the host reboots.
- Remove persistence – Completely remove the persistent connection.

Node List Block
List of all persistent connections that have ever checked in to the server.

Fields:

- Hash – Unique hash of the host where the persistence is installed. Clicking on it leads to a page with detailed information on the connection, host, tasks, etc.
- Group – Group assigned to the host.
- Server Tag – Identifier of the last proxy server used for check-in.
- IP/Verified – External IP from which the connection was made and a list of verified addresses.
- Last Heartbeat – Date/time of the last check-in.
- Last Task – Summary of the last assigned task.
- Description – Comment on the host.
- Action – Active buttons:
  - Edit (Save/Cancel) – Edit comments.
  - Verify (Hash+IP) – Verify the IP used for check-in.
  - Verify (Hash+AnyIP) – Allow check-ins from any IP for this connection.
- + – Additional information about the persistent connection.

Node Information Page
Detailed information about the persistent connection and host.

Tabs:

- Overview – General information.
- Log – Event logs for the host.
- Tasks – Task assignments and history.
- systeminfo – Output from the [systeminfo] command.
- netview – Output from the [net view] command.
- netstat – Output from the [netstat /naop TCP] command.
- tasklist – Output from the [tasklist /v] command.
- netstart – Output from the [net start] command.
- ipconfig – Output from the [ipconfig /all] command.
- domainadmins – Output from [net group "domain admins" /domain].

Shell Nodes Page
List of reverse shells launched via the SHELL module or RunSchedulerTaskOnce.ps1.

Fields:

- Hash – Unique hash of the host where the shell is running.
- IP – Address from which the shell was established.
- Group – Group assigned to the host.
- Status – Active/inactive shell.
- Type – SHELL (basic shell) or VNC (remote desktop access).
- Port – Connection port (if applicable).
- Description – Comment on the host.
- Action – Active buttons: Edit (Save/Cancel).

Proxifier Page
List of connections established to the proxy server using SOCKS/FTP/VNC modules.

Fields:

- Hash – Unique hash of the host running the module.
- Port – Connection port for the respective protocol.
- Group – Assigned group.
- Description – Host comment.

Task List Page
List of all tasks previously assigned to persistent connections. Unfinished tasks can be removed with the Remove selected button.

Fields:

- Assigned to – Unique hash of the infected host.
- Code – Task ID.
- Text – Task details.
- Created Date – Task creation date.
- Completed Date – Task completion date.
- Status – Task execution status.
- Result Text – Brief result summary.
- + – Detailed task execution output.

Task Statuses:

- Created – Task is created and will be assigned upon the next check-in.
- Pending – Task has been sent to the host and is awaiting execution.
- Success – Task executed successfully.
- Failure – Task execution failed (error code provided).
- Unknown – Unexpected response received; execution status unknown.

[bc]
Console utility for connecting to infected hosts for interactive sessions.

Available commands:

- help – Display command list.
- q – Quit.
- lc – List active clients.
- lch – List active shell channels.
- lm – List running modules.
- ul – Upload file.
- dl – Download file.
- st – Steal authentication token.
- tun – Launch SOCKS5 proxy module.
- ft – Launch FTP module.
- vnc – Start VNC remote session.
- kl – Start keylogger.
- pvt – Set up a pivot proxy.
- pth – Execute process using stolen NTLM hash.

[ps_scripts]
PowerShell-based scripts for execution on infected hosts.

Scripts:

- RunSchedulerTask.ps1 – Install persistence via Task Scheduler.
- RunSchedulerTaskU.ps1 – Install persistence without admin rights.
- RunSchedulerTaskOnce.ps1 – Launch a reverse shell.
- RunPvt.ps1 – Set up a redirecting proxy.
