Procedure examples

Turian has the ability to take screenshots.

BADHATCH can take screenshots and send them to an actor-controlled C2 server.

Machete captures screenshots.

Prikormka contains a module that captures screenshots of the victim's desktop.

Woody RAT has the ability to take a screenshot of the infected host desktop using Windows GDI+.

Mafalda can take a screenshot of the target machine and save it to a file.

SHUTTERSPEED can capture screenshots.

FlawedAmmyy can capture screenshots.

Cuckoo Stealer can run `screencapture` to collect screenshots from compromised hosts.

InvisiMole can capture screenshots of not only the entire screen, but of each separate window open, in case they are overlapping.

FruitFly takes screenshots of the user's desktop.

RDAT can take a screenshot on the infected system.

TRANSLATEXT has the ability to capture screenshots of new browser tabs, based on the presence of the `Capture` flag.

Mispadu has the ability to capture screenshots on compromised hosts.

VERMIN can perform screen captures of the victim’s machine.

HTTPTroy has obtained screen captures leveraging the `screen` command which captures, encrypts and uploads the stolen image to the adversary controlled C2 server.

MarkiRAT can capture screenshots that are initially saved as ‘scr.jpg’.

Kazuar captures screenshots of the victim’s screen.

POORAIM can perform screen capturing.

CHIMNEYSWEEP can capture screenshots on targeted systems using a timer and either upload them or store them to disk.

BlackEnergy is capable of taking screenshots.

Chrommme has the ability to capture screenshots.

ObliqueRAT can capture a screenshot of the current screen.

XAgentOSX contains the takeScreenShot (along with startTakeScreenShot and stopTakeScreenShot) functions to take screenshots using the CGGetActiveDisplayList, CGDisplayCreateImage, and NSImage:initWithCGImage methods.

LightSpy uses Apple's built-in AVFoundation Framework library to access the user's camera and screen. It uses the `AVCaptureStillImage` to take a picture using the user's camera and the `AVCaptureScreen` to take a screenshot or record the user's screen for a specified period of time.

KeyBoy has a command to perform screen grabbing.

HyperBro has the ability to take screenshots.

Pteranodon can capture screenshots at a configurable interval.

ROKRAT can capture screenshots of the infected system using the `gdi32` library.

PlugX allows the operator to capture screenshots.

Lumma Stealer has taken screenshots of victim machines.

DustySky captures PNG screenshots of the main screen.

Rover takes screenshots of the compromised system's desktop and saves them to C:\system\screenshot.bmp for exfiltration every 60 minutes.

Peppy can take screenshots on targeted systems.

Clambling has the ability to capture screenshots.

SVCReady can take a screenshot from an infected host.

Carbanak performs desktop video recording and captures screenshots of the desktop and sends it to the C2 server.

Hydraq includes a component based on the code of VNC that can stream a live feed of the desktop of an infected host.

Chaes can capture screenshots of the infected machine.

LODEINFO has the ability to take screenshots.

CharmPower has the ability to capture screenshots.

SMOKEDHAM can capture screenshots of the victim’s desktop.

Metamorfo can collect screenshots of the victim’s machine.

Trojan.Karagany can take a desktop screenshot and save the file into \ProgramData\Mail\MailAg\shot.png.

Bandook is capable of taking an image of and uploading the current desktop.

KONNI can take screenshots of the victim’s machine.

T9000 can take screenshots of the desktop and target application windows, saving them to user directories as one byte XOR encrypted .dat files.

gh0st RAT can capture the victim’s screen remotely.

A JHUHUGIT variant takes screenshots by simulating the user pressing the "Take Screenshot" key (VK_SCREENSHOT), accessing the screenshot saved in the clipboard, and converting it to a JPG image.

BLUELIGHT has captured a screenshot of the display every 30 seconds for the first 5 minutes after initiating a C2 loop, and then once every five minutes thereafter.