[Update] Allium | Loader & C2 Framework | In-Memory Exec | Browser Stealer | Go Panel

 

Overview

Allium is a remote agent management framework built for operators who need resilient infrastructure, in-memory execution, and browser credential extraction in a single deployable package.
 

• Go panel, single binary, zero dependencies, no PHP/MySQL/nginx
  
• C++ agent, native, no .NET runtime, no JRE
  
• ChaCha20Poly1305 + Argon2id encrypted communications
  
• API obfuscation, imported functions are not exposed
  
• Direct syscalls, no ntdll.dll stubs
  

 

---

EtherHide

Infrastructure takedowns do not work against Allium.

The agent retrieves its C2 address from blockchain data via public RPC endpoints. No domains, no fixed IPs, no DNS records to sinkhole. If your VPS gets reported and taken offline, you create a new one, update the address on-chain, and agents reconnect on their next execution. The entire rotation costs pennies and takes literal seconds.
 

• No domain to report or seize
  
• No fixed IP for infrastructure analysts to block
  
• IP rotation in seconds, cheap cost
  
• Agents survive C2 takedown indefinitely
  
• Public RPC endpoints blend in as normal blockchain traffic
  

In-Memory Execution, Transacted Hollowing

Transaction based in-memory execution. No files committed to disk.

A transaction is created, a file is written transacted, a section is mapped from it, and the transaction is rolled back. The mapped section persists in memory but the backing file never commits to disk. When EDR section callbacks fire and attempt to resolve the backing image, there is nothing to scan.
 

• No WriteProcessMemory
  
• No CreateRemoteThread
  
• No files on disk
  
• Section backed by a transacted file handle that no longer exists after rollback
  

The technique is evasion by design. Because the backing file is rolled back before execution begins, there is no file for scanning engines to inspect. Validated in real environments with Windows Defender real-time protection active and scanning.

API Obfuscation & Direct Syscalls

The agent does not resolve or call Windows API functions through normal import tables. Imported functions are obfuscated and resolved at runtime, meaning static analysis of the binary does not reveal which APIs the agent uses.

All sensitive operations are performed via direct syscalls. The agent does not call through ntdll.dll stubs, which are the most common hooking points for EDR products. Instead, syscall numbers are resolved and executed directly, bypassing userland hooks entirely.

Agent
 

• No CIS region locks, agent executes in any geographic region without restrictions
  
• Optional Microsoft DLL only loading, the agent restricts DLL dependencies to Microsoft signed binaries only, preventing DLL hijacking and injection of unauthorized modules into the agent process
  
• Optional AntiVM, the agent can detect virtual machine environments and exit silently if configured to do so
  
• Optional AntiAnalysis, the agent can detect the presence of popular malware analysis tools and exit when found
  

 

---

 

Execution Options
 

• Download & execute (disk), supports exe, dll, vbs, js, bat, msi, hta with configurable drop path, subfolder, filename, parameters, and UAC elevation
  
• Download & execute (in-memory), transacted hollowing, inject into RuntimeBroker/dllhost/svchost
  
• Download & execute (.NET in-memory), optional AMSI patch
  
• NEW UAC Bypass, silent privilege elevation without prompting the user, no UAC dialog, no consent screen
  
• Command execution, with output return
  
• Browser Stealer, ChromElevator binary with support for AppBound Encryption
  
• NEW Crypto Wallet Stealer, extracts keys from desktop wallets and browser extension wallets
  
• File hosting, upload payloads to panel and generate random links for download & execute tasks
  
• Client update, remote binary replacement
  
• Client uninstall, remote cleanup
  

Task Intelligence

Every task supports filtering by agent attributes, allowing precise deployment.
 

• Filter by: country, OS, version, antivirus, privileges, HWID, username, hostname
  
• Exclude syntax (e.g. !US, !Kaspersky)
  
• "Execute always" stager with configurable max executions, deploy multiple payloads intelligently to first sessions
  
• Task priority system
  

 

---

 

Browser Credential Extraction

One of the built-in capabilities of Allium is browser credential extraction with AppBound key decryption via ChromElevator, executed through transacted hollowing. No disk artifacts from the extraction tool itself.

Supported browsers: Chrome, Edge, Brave, Avast Secure Browser.

Collected data:

• Saved passwords (URL, user/email, password)
  
• Session cookies
  
• Saved credit cards (Holder name, CVV, expiration date)
  
• OAuth tokens (to log into Google accounts)
  

Logs are organized by agent and timestamp in the panel for download and offline analysis.

Crypto Wallet Extraction NEW

Allium now extracts cryptocurrency wallet data from both desktop applications and browser extensions.

Desktop wallets:

• Exodus
  
• Electrum
  
• Atomic Wallet
  
• Bitcoin Core
  
• Ethereum (Mist / geth keystore)
  
• Litecoin Core
  
• Dash Core
  
• Monero GUI
  
• More...
  

Browser extension wallets (Chrome, Edge, Brave), such as:

• MetaMask
  
• Binance Chain Wallet
  
• Coinbase Wallet
  
• Phantom (Solana)
  
• Trust Wallet
  
• TronLink
  
• Ronin Wallet
  
• Solflare
  
• More...
  

Extracted data includes desktop wallet files, and extension Local Extension Settings data. Logs are organized by agent and timestamp in the panel.

AMSI Patch
 

• AmsiScanBuffer patch for .NET in-memory execution
  

UAC Bypass NEW
 

• Silent privilege elevation without UAC consent prompt
  
• No dialog, no notification, no user interaction required
  
• Works on Windows 10 and Windows 11
  
• Agent can execute tasks with admin privileges on standard user accounts
  

 

---

Panel

Single Go binary. Run it, it works.
 

• Dashboard with OS/AV/country/version distribution charts
  
• World map with bot geolocation
  
• Bot management with search, filter, pagination
  
• Task creation with dynamic parameter forms
  
• Stealer logs organized by agent and timestamp
  
• NEW File hosting, upload payloads to the panel and generate shareable links with randomized non-numeric IDs
  

 

---

Video Demo
 

---

Pricing
 
 

• Lifetime license, no subscriptions, no recurring payments
  
• Panel + agent included
  
• 1 free rebuild included
  
• Additional rebuilds: $50
  

 

---

Terms of Service
 

• You may not reverse engineer, decompile, or disassemble the panel or agent binaries
  
• You may not attempt to crack, bypass, or remove the program's protection
  
• You may not resell, redistribute, or share the panel binary, agent binary, or any associated files
  
• You may not transfer your license to another user without explicit permission
  
• Rebuilds are tied to the original license, resold licenses will be revoked
  
• By purchasing, you agree to these terms
  

Disclaimer

Allium is provided for educational and authorized security testing purposes only. The author is not responsible for any misuse, damage, or illegal activity performed with this software. The buyer assumes all responsibility for compliance with applicable laws in their jurisdiction.

HackForums thread here.

Contact
 

• Telegram: @pyriteuser
  
• Tox: 04CA2F4380D23A5D6039B852AD15CA2FADDF0BA472BAA04E1CD43FD3D9DE9322527ED80EB953
  
• LeakForums DM