We stopped C2 development to work on this new project
sequenceDiagram
autonumber
box "Victim Machine" #222
participant User as User/Gamer
participant MC as Minecraft (Java)
participant Mod as Niggaware Mod
participant FS as File System
participant GD as Guardian (GoLang)
end
box "C2 Infrastructure" #444
participant Panel as Panel API (Python)
participant WS as WebSocket Server
participant DB as Database
participant Disc as Discord Webhook
end
Note over User, Mod: PHASE 1: INJECTION & STEALING
User->>MC: Launches Minecraft (Official/Feather/Lunar/etc.)
MC->>Mod: Loads Mod (Fabric/Forge)
activate Mod
Mod->>Mod: Check Environment (APPDATA/OS)
par Data Extraction (Parallel Threads)
Mod->>FS: Scan 9+ Launchers (McExtractor)
Mod->>FS: Scan Browsers (Chrome/Edge/Opera) for Passwords/Cookies
Mod->>FS: Scan Discord (Tokens & HQ Friends)
Mod->>FS: Scan Telegram/Steam/Ubi/Battlenet
end
Mod->>FS: Create ZIP Archive (Reliable/Retry logic)
Mod->>Panel: POST /api/v1/data/upload (Multipart/form-data)
Note right of Mod: Headers: X-IP, X-Country, X-OS
activate Panel
Panel->>DB: Store Loot & Logs
Panel-->>Disc: Send Notification (Embeds)
Panel-->>Mod: 200 OK
deactivate Panel
Note over User, Mod: PHASE 2: PERSISTENCE & DROPPER
Mod->>Panel: GET /api/v1/guardian/latest (Check Hash)
Panel-->>Mod: Returns Binary + Checksum
Mod->>FS: Drop Guardian to Hidden Path (AppData/WinSvc)
Mod->>Mod: Set File Attributes (Hidden/System)
Mod->>FS: Execute Guardian.exe (Detached Process)
deactivate Mod
activate GD
Note over GD, WS: PHASE 3: GUARDIAN ACTIVATION (GoLang)
GD->>GD: Anti-VM / Anti-Debug Checks
GD->>FS: Install Persistence (Registry/Startup)
loop Connection Loop
GD->>WS: WebSocket Handshake (Protocol 40)
WS-->>GD: Connection Accepted
end
GD->>WS: Register Client (HWID, IP, OS, User)
WS->>DB: Update Online Status
loop Heartbeat & Command Polling
WS->>GD: Ping
GD-->>WS: Pong
opt Admin Command Received
WS->>GD: CMD: {type: "shell", cmd: "whoami"}
GD->>FS: Execute Command
GD-->>WS: Result: "nt authority\system"
end
opt Feature: Remote Desktop
WS->>GD: CMD: {type: "start_stream"}
GD->>WS: Stream Video Frames (MJPEG/H.264)
end
opt Feature: File Manager
WS->>GD: CMD: {type: "ls", path: "C:/"}
GD-->>WS: File List JSON
end
end