GitHub - X-ZIGZAG/X-ZIGZAG: X-ZIGZAG is a lightweight RAT engineered for stealth, operating exclusively in RAM. By X-SP33D Archived: 2026-04-05 16:14:13 UTC X-ZIGZAG is a lightweight and stealthy RAT designed for educational purposes. With a focus on small size and undetectability, X-ZIGZAG operates entirely in RAM, ensuring no traces are left on the target system. This tool is built without relying on any external libraries or third-party dependencies, making it both efficient and versatile. 🚨 Disclaimer This project is for educational purposes only. Unauthorized use on any system without the owner’s explicit consent is illegal and unethical. The creator assumes no responsibility for any misuse or damage caused by this software. 🌟 Key Features πŸ’£ Self Destruct: Completely erase itself from the system without leaving any trace. ⬇️ Download: Fetch and execute files from a remote server. πŸ“Ά WiFi Passwords: Retrieve stored WiFi passwords effortlessly. https://github.com/X-ZIGZAG/X-ZIGZAG Page 1 of 3 πŸ” Chromium Browsers Data: Extract saved passwords, credit card details, and cookies from Chromium-based browsers. ️ System Info: Gather comprehensive system information. πŸ“Έ Screenshots: Capture screenshots of the target machine in real-time. πŸ“€ Upload: Seamlessly send files from the target system to your server. ️ VPN/Proxy Detection: Detect if the user is accessing the endpoints via a VPN or proxy. If detected, the RAT will shut down immediately. 🚫 BlackList IPs: Automatically avoid communication with IP addresses from known data centers (e.g., Google, Amazon, Azure, OVH). If the RAT detects that it is running from one of these IPs, it will shut down without performing any actions. πŸ‘» Hide: Operate in stealth mode to avoid detection. ♻️ AutoStart Setup: Establish persistence on the target machine for continuous operation. πŸ›‘ VM/Server/RDP/VPS Detection: Prevent execution in virtualized environments, servers, or remote desktop sessions. ️ CMD / PowerShell Execution: Execute custom commands via CMD or PowerShell. πŸ”§ Execute C# or VB.NET Code: Run custom C# or VB.NET code dynamically on the target system. βš™οΈ How It Works πŸ”— Communication: X-ZIGZAG communicates with a predefined server endpoint at intervals specified by the creator. It retrieves and executes instructions, returning results to the server for later analysis if necessary. 🧠 In-RAM Operation: All operations are executed in RAM, ensuring that no files are written to the disk, significantly reducing the risk of detection. βš–οΈ Legal & Ethical Considerations The use of X-ZIGZAG on any system without explicit permission from the system’s owner is illegal. This tool is intended purely for educational purposes, allowing security professionals to study and understand the tactics, techniques, and procedures (TTPs) employed by malicious actors. ️ Technologies Used Client (Target Machine): .NET Framework 4.6.1 - Windows Forms Application Server Side: ASP.NET 8 Web API, Entity Framework, PostgreSQL, Angular 18 πŸš€ Installation For a comprehensive installation guide, please refer to the release section of our GitHub repository: X-ZIGZAG Releases. Get started with ease by following the detailed instructions provided there! https://github.com/X-ZIGZAG/X-ZIGZAG Page 2 of 3 πŸ“ƒ To-Do List πŸ“„ Firefox Browser Data πŸ“Έ Webcam (Not stable and too risky) πŸ“ Keylogger (Doesn't support all keyboard layouts) πŸ”΄ Live Interaction (Using sockets) πŸ‘» Improve Undetectability ⚑ Optimize Size πŸ”§ Contribution Contributions are welcome! Please fork this repository, create a feature branch, and submit a pull request. ©️ License This project is licensed under the MIT License. See the LICENSE file for more details. ️ Stay ethical, stay safe. Source: https://github.com/X-ZIGZAG/X-ZIGZAG https://github.com/X-ZIGZAG/X-ZIGZAG Page 3 of 3