Procedure examples

RCSession can capture screenshots from a compromised host.

QuietSieve has taken screenshots every five minutes and saved them to the user's local Application Data folder under `Temp\SymbolSourceSymbols\icons` or `Temp\ModeAuto\icons`.

GRIFFON has used a screenshot module that can be used to take a screenshot of the remote system.

yty collects screenshots of the victim machine.

DOGCALL is capable of capturing screenshots of the victim's machine.

POWRUNER can capture a screenshot from a victim.

SharpStage has the ability to capture the victim's screen.

HALFBAKED can obtain screenshots from the victim.

KEYMARBLE can capture screenshots of the victim’s machine.

Ursnif has used hooked APIs to take screenshots.

ZLib has the ability to obtain screenshots of the compromised system.

RedLeaves can capture screenshots.

Zeus Panda can take screenshots of the victim’s machine.

Havoc can capture screenshots.

Matryoshka is capable of performing screen captures.

Janicab captured screenshots and sent them out to a C2 server.

TONESHELL has conducted screen capturing.

Kasidet has the ability to initiate keylogging and screen captures.

RainyDay has the ability to capture screenshots.

AppleSeed can take screenshots on a compromised host by calling a series of APIs.

NETWIRE can capture the victim's screen.

CosmicDuke takes periodic screenshots and exfiltrates them.

EvilGrab has the capability to capture screenshots.

Aria-body has the ability to capture screenshots on compromised hosts.

Crimson contains a command to perform screen captures.

DUSTTRAP can capture screenshots.

Turian has the ability to take screenshots.

BADHATCH can take screenshots and send them to an actor-controlled C2 server.

Machete captures screenshots.

Prikormka contains a module that captures screenshots of the victim's desktop.

Woody RAT has the ability to take a screenshot of the infected host desktop using Windows GDI+.

Mafalda can take a screenshot of the target machine and save it to a file.

SHUTTERSPEED can capture screenshots.

FlawedAmmyy can capture screenshots.

Cuckoo Stealer can run `screencapture` to collect screenshots from compromised hosts.

InvisiMole can capture screenshots of not only the entire screen, but of each separate window open, in case they are overlapping.

FruitFly takes screenshots of the user's desktop.

RDAT can take a screenshot on the infected system.

TRANSLATEXT has the ability to capture screenshots of new browser tabs, based on the presence of the `Capture` flag.

Mispadu has the ability to capture screenshots on compromised hosts.

VERMIN can perform screen captures of the victim’s machine.

HTTPTroy has obtained screen captures leveraging the `screen` command which captures, encrypts and uploads the stolen image to the adversary controlled C2 server.

MarkiRAT can capture screenshots that are initially saved as ‘scr.jpg’.

Kazuar captures screenshots of the victim’s screen.

POORAIM can perform screen capturing.

CHIMNEYSWEEP can capture screenshots on targeted systems using a timer and either upload them or store them to disk.

BlackEnergy is capable of taking screenshots.

Chrommme has the ability to capture screenshots.

ObliqueRAT can capture a screenshot of the current screen.

XAgentOSX contains the takeScreenShot (along with startTakeScreenShot and stopTakeScreenShot) functions to take screenshots using the CGGetActiveDisplayList, CGDisplayCreateImage, and NSImage:initWithCGImage methods.