Not fishy at all! It's like a lockpicking fan asking about locksport.

If you're looking for examples, GitHub has a lot of CVE proof-of-concepts and there are lots of payload git repos across git hosts in general, but if you're looking for a one-stop-shop "Steal all credentials," or "Work on all OSes/architectures just by switching the compile target," then you'll have a harder time. (A do-one-thing-well approach is more maintainable after all.)

If you want to make something yourself that still tries to pull off the take-as-much-as-you-can, you should just search up how different apps store data and whether it's easy to grab. Like, where browsers store their cookies, or the implications of X11's security model (Linux-specific), or where Windows/Windows apps' credentials and hashes are stored. Of course, there's only much a payload can do without a vulnerability exploit to partner with (e.g. Is privilege escalated? Are we still in userland? is this just a run-of-the-mill Trojan?).

Apologies if my answer is too general.