Veneficus Mini

A friend sent me a zip and a warning, and this time the warning was not theatre. The zip was source: a Windows x64 implant written as if someone had sat down to ship a product rather than a one-file crime, and they had named it Veneficus Mini. Veneficus is Latin for poisoner, and also sorcerer, so the name is doing both jobs at once.

I did not write this kit. Credit: @YoSoth0, who passed the tree over. I read every module. We decided it was in the public's best interest to release the source as-is, slightly broken, because a finished copy of this shape is too dangerous to hand the internet. The tree is on GitHub: abraxas/veneficus. You will figure out how to recreate a working build if you are elite enough. The rest of us can hunt the design.

What you get is a PowerShell stager, a Rust PE, and a Cloudflare Worker that wants to page an operator on Telegram. The kill chain the crate is built around is the whole point: exploit, escalate, pivot, poison, C2. The exploits in the driver pool are public n-days. The kit is not. There is no named family in the catalogs and no public PE. That is the 0-day: the implant as a product.

This is the write-up: analysis-level, the map rather than a compiler input. Static review only. No cargo build. No detonation.

Too spicy for you

I am not going to print patch bytes, control-code numbers, XOR keys, or a dropper you can paste into a victim. The GitHub tree is the primary source. These pages are the notes I took while walking it. If you can reconstruct a working implant from a slightly broken crate, you already had the skill, and you did not need me for the last mile.

Public CVE identifiers stay. Vendor product names that the tree itself uses stay, because the source is public now. I am still not going to walk you through making the broken parts compile, load a .sys, or talk to a live Worker.

What I actually got

This is not a one-file crime. It is a crate named veneficus_mini 3.0, aimed at x86_64-pc-windows-gnu, with feature flags for BYOVD and DKOM, a release profile that strips symbols, turns on link-time optimization, aborts on panic, and optimizes for size. A compile-time agent id is baked by build.rs and then used as both identity toward the relay and the seed for AES-256-GCM. The orchestrator scores the host, branches, spawns work, and then enters a control loop that is typed as never returning.

Four phases, a score, a branch, a handful of threads, and a loop that does not return: that is how you write an agent when you are thinking in modules instead of pastes.

The clipper is the module that ends the "red-team implant" story, because red teams do not steal victim funds. A sketch this modular is still rarer than a working stealer with a single main, which is the whole reason the zip was worth sitting with.

What this is not

It is not VenomRAT. It is not VEN0m ransomware. It is not the Brazilian VENON banker. It is not Golden Gh0st. Public intel has no named family called Veneficus Mini. What is in the wild are the techniques it uses: BYOVD process-kill helpers, in-process AMSI and ETW patches, clipboard swap, Cloudflare-fronted C2, and Telegram as an operator console.

It is not a worm, it is not a browser exploit, and it is not macOS or Linux on the victim side. Linux is the build host; the target is Windows 10/11 x64.

It is not a 0-day in a vendor product. The kernel helpers it wants are public n-days: CVE-2025-1055, CVE-2025-7771, CVE-2025-70795, and the rest of the pool already have advisories. The kit does not.

How to read this

Five pages. The intro is the handshake, and the rest of the series follows the kit in the order the orchestrator thinks. The GitHub tree is the primary source; these pages are the notes.

1. Phase 0 - Introduction (you are here). The zip, the name, the rules.
2. Phase 1 - The kit. Crate, intended flow, the phase machine.
3. Phase 2 - The host decides. Scoring, concealment, persistence, retirement.
4. Phase 3 - The teeth. Harvest, clipper, secret-store dump, the BYOVD pool.
5. Phase 4 - The wire. Channel crypto, the edge worker, the command surface.

If a later compiled build shows up in the wild, hunt the design, not a hash I do not have. The PE does not start with theft. It starts with a number.