Windows 10/11
Vesper
A per-build payload forge for Windows. Every generated implant speaks a different wire dialect, carries different embedded constants, and produces a different binary hash — no shared path, header, key, magic, or framing between builds.
Platform
Windows 10/11
Language
Rust (stdlib-only implant)
Stack
Rust C2 Windows PE Loader AES-GCM HTTP
Status
Phase 1 complete

// Architecture

Two builds of the same implant, side by side. Every observable — key, framing, HTTP path, binary hash — differs per build; the C2 server is the only component they share, and the wire carries no repeating byte string.

─────────────────────────────────────────────────────────────────────────
Overview

Vesper is a C2 framework built around one core principle: no two builds should share any observable artifact. The forge generates a unique wire protocol dialect per seed — different framing, different keys, different HTTP shape — so network defenders cannot signature-match across campaigns. The implant uses only Rust's standard library, keeping the attack surface minimal and the binary clean.

Architecture
>
vesper-core
Wire protocol, dialect derivation, crypto, HTTP/1.1 client. The language the implant and server speak.
>
vesper-forge
Build generator: seed → compile → manifest. Every seed produces a distinct binary with no shared constants.
>
vesper-loader
In-memory PE loader: PE reader, overlay extraction, in-memory mapping. No temp files, no disk writes.
>
vesper-operator
CLI for session management, task dispatch, result watching. Web console SPA as an alternative interface.
>
vesper-server
Beacon listener + operator API. Listener binds are independent — multiple listeners, each with its own payload profile.
vesper-operator
$ vesper-operator listen --bind 0.0.0.0:18080 ✓ listener l18080 active url: http://10.0.0.5:18080 interval: 5000ms $ vesper-operator build --listener l18080 ✓ forge seed a3f8c1d2 dialect: http-shaped-v7 hash: b4e9a1... (unique) ✓ implant written to runs/