Procedure examples

Smoke Loader searches through Outlook files and directories (e.g., inbox, sent, templates, drafts, archives, etc.).

CosmicDuke searches for Microsoft Outlook data files with extensions .pst and .ost for collection and exfiltration.

Emotet has been observed leveraging a module that scrapes email data from Outlook.

Crimson contains a command to collect and exfiltrate emails from Outlook.

Carbanak searches recursively for Outlook personal storage tables (PST) files within user directories and sends them back to the C2 server.

KGH_SPY can harvest data from mail clients.

LunarMail can capture the recipients of sent email messages from compromised accounts.

QakBot can target and steal locally stored emails to support thread hijacking phishing campaigns.

Empire has the ability to collect emails on a target system.

Out1 can parse e-mails on a target machine.

Pupy can interact with a victim’s Outlook session and look through folders and emails.

Some SeaDuke samples have a module to extract email from Microsoft Exchange servers using compromised credentials.

LightNeuron collects Exchange emails matching rules specified in its configuration.

Valak can collect sensitive mailing information from Exchange servers, including credentials and the domain certificate of an enterprise.

MailSniper can be used for searching through email in Exchange and Office 365 environments.

PAKLOG has monitored and extracted clipboard contents.

Zeus Panda can hook GetClipboardData function to watch for clipboard pastes to collect.

InvisibleFerret has stolen data from the clipboard using the Python project “pyperclip”. InvisibleFerret has also captured clipboard contents during copy and paste operations.

BOOKWORM has used its KBLogger.dll module to steal data saved to the clipboard.

CosmicDuke copies and exfiltrates the clipboard contents every 30 seconds.

Machete hijacks the clipboard data by creating an overlapped window that listens to keyboard events.

FlawedAmmyy can collect clipboard data.

Mispadu has the ability to capture and replace Bitcoin wallet data in the clipboard on a compromised host.

VERMIN collects data stored in the clipboard.

MarkiRAT can capture clipboard content.

DarkComet can steal data from the clipboard.

CHIMNEYSWEEP can capture content from the clipboard.

DarkTortilla can download a clipboard information stealer module.

ROKRAT can extract clipboard data from a compromised host.

RunningRAT contains code to open and copy data from the clipboard.

Explosive has a function to use the OpenClipboard wrapper.

Clambling has the ability to capture and store clipboard data.

DarkGate starts a thread on execution that captures clipboard data and logs it to a predefined log file.

Metamorfo has a function to hijack data from the clipboard by monitoring the contents of the clipboard and replacing the cryptocurrency wallet with the attacker's.

KONNI had a feature to steal data from the clipboard.

A JHUHUGIT variant accesses a screenshot saved in the clipboard and converts it to a JPG image.

Catchamas steals data stored in the clipboard.

Attor has a plugin that collects data stored in the Windows clipboard by using the OpenClipboard and GetClipboardData APIs.

RTM collects data from the clipboard.

Grandoreiro can capture clipboard data from a compromised host.

XLoader can collect data stored in the victim's clipboard.

MgBot can capture clipboard data.

Cadelspy has the ability to steal data from the clipboard.

TajMahal has the ability to steal data from the clipboard of an infected host.

TinyZBot contains functionality to collect information from the clipboard.

Melcoz can monitor content saved to the clipboard.

Agent Tesla can steal data from the victim’s clipboard.

Remexi collects text from the clipboard.

Astaroth collects information from the clipboard by using the OpenClipboard() and GetClipboardData() libraries.

jRAT can capture clipboard data.