Procedure examples

Chaes has a module to perform any API hooking it desires.

Kobalos has used a compromised SSH client to capture the hostname, port, username and password used to establish an SSH connection from the compromised host.

metaMain can log mouse events.

NPPSPY captures user input into the Winlogon process by redirecting RPC traffic from legitimate listening DLLs within the operating system to a newly registered malicious item that allows for recording logon information in cleartext.

RCSession has the ability to capture keystrokes on a compromised host.

yty uses a keylogger plugin to gather keystrokes.

DOGCALL is capable of logging keystrokes.

PAKLOG has captured keystrokes using Windows API.

Zeus Panda can perform keylogging on the victim’s machine by hooking the functions TranslateMessage and WM_KEYDOWN.

Matryoshka is capable of keylogging.

InvisibleFerret has conducted keylogging using the Python project “pyWinHook” and "Pyhook". InvisibleFerret has also captured keylogging thread checks for changes in an active window and key presses.

TONESHELL has capabilities to conduct keylogging.

Kasidet has the ability to initiate keylogging.

AppleSeed can use GetKeyState and GetKeyboardState to capture keystrokes on the victim’s machine.

NETWIRE can perform keylogging.

BOOKWORM has used its KBLogger.dll module to capture keystrokes and stored them in a folder.

CosmicDuke uses a keylogger.

EvilGrab has the capability to capture keystrokes.

SslMM creates a new thread implementing a keylogging facility using Windows Keyboard Accelerators.

GreyEnergy has a module to harvest pressed keystrokes.

Crimson can use a module to perform keylogging on compromised hosts.

DUSTTRAP can perform keylogging operations.

Machete logs keystrokes from the victim’s machine.

PowerLess can use a module to log keystrokes.

Prikormka contains a keylogger module that collects keystrokes and the titles of foreground windows.

HexEval Loader has utilized a cross-platform keylogger that has the capability to capture keystrokes on Windows, macOS and Linux systems.

FlawedAmmyy can collect keyboard events.

InvisiMole can capture keystrokes on a compromised host.

Okrum was seen using a keylogger tool to capture keystrokes.

Regin contains a keylogger.

Mispadu can log keystrokes on the victim's machine.

Fysbis can perform keylogging.

VERMIN collects keystrokes from the victim machine.

MarkiRAT can capture all keystrokes on a compromised host.

NavRAT logs the keystrokes on the targeted system.

DarkComet has a keylogging capability.

CHIMNEYSWEEP has the ability to support keylogging.

BlackEnergy has run a keylogger plug-in on a victim.

XAgentOSX contains keylogging functionality that will monitor for active application windows and write them to the log, it can handle special characters, and it will buffer by default 50 characters before sending them out over the C2 infrastructure.

KeyBoy installs a keylogger for intercepting credentials and keystrokes.

DarkTortilla can download a keylogging module.

ROKRAT can use `SetWindowsHookEx` and `GetKeyNameText` to capture keystrokes.

RunningRAT captures keystrokes and sends them back to the C2 server.

DarkWatchman can track key presses with a keylogger module.

PlugX has a module for capturing keystrokes per process including window titles.

DustySky contains a keylogger.

Remsec contains a keylogger component.

Sykipot contains keylogging functionality to steal passwords.

Explosive has leveraged its keylogging capabilities to gain access to administrator accounts on target servers.

Rover has keylogging functionality.