Procedure examples

Micropsia takes screenshots every 90 seconds by calling the Gdi32.BitBlt API.

RedLine Stealer can capture screenshots on a compromised host.

Catchamas captures screenshots based on specific keywords in the window’s title.

StoneDrill can take screenshots.

RogueRobin has a command named $screenshot that may be responsible for taking screenshots of the victim machine.

Attor's has a plugin that captures screenshots of the target applications.

LitePower can take system screenshots and save them to `%AppData%`.

NightClub can load a module to call `CreateCompatibleDC` and `GdipSaveImageToStream` for screen capture.

RTM can capture screenshots.

Derusbi is capable of performing screen captures.

BadPatch captures screenshots in .jpg format and then exfiltrates them.

XLoader can capture screenshots on compromised hosts.

A variant of Zebrocy captures screenshots of the victim’s machine in JPEG and BMP format.

FinFisher takes a screenshot of the screen and displays it on top of all other windows for few seconds in an apparent attempt to hide some messages showed by the system during the setup process.

LunarMail can capture screenshots from compromised hosts.

CrossRAT is capable of taking screen captures.

Cadelspy has the ability to capture screenshots and webcam photos.

Cobalt Strike's Beacon payload is capable of capturing screenshots.

Cobian RAT has a feature to perform screen capture.

HotCroissant has the ability to do real time screen viewing on an infected host.

Valak has the ability to take screenshots on a compromised host.

Kivars has the ability to capture screenshots on the infected host.

TajMahal has the ability to take screenshots on an infected host including capturing content from windows of instant messaging applications.

Raccoon Stealer can capture screenshots from victim systems.

Daserf can take screenshots.

Cardinal RAT can capture screenshots.

BISCUIT has a command to periodically take screenshots of the system.

Ramsay can take screenshots every 30 seconds as well as when an external removable storage device is connected.

The AshTag AshenOrchestrator component has the ability to take screenshots.

Carberp can capture display screenshots with the screens_dll.dll plugin.

NKAbuse can take screenshots of the victim machine.

Revenge RAT has a plugin for screen capture.

MacMa has used Apple’s Core Graphic APIs, such as `CGWindowListCreateImageFromArray`, to capture the user's screen and open windows.

The FunnyDream ScreenCap component can take screenshots on a compromised host.

SysUpdate has the ability to capture screenshots.

TinyZBot contains screen capture functionality.

Proton captures the content of the desktop with the screencapture binary.

LookBack can take desktop screenshots.

PoetRAT has the ability to take screen captures.

CHOPSTICK has the capability to capture screenshots.

ZxShell can capture screenshots.

Cannon can take a screenshot of the desktop.

Troll Stealer can capture screenshots from victim machines.

njRAT can capture screenshots of the victim’s machines.

TURNEDUP is capable of taking screenshots.

Manjusaka can take screenshots of the victim desktop.

metaMain can take and save screenshots.

XCSSET saves a screen capture of the victim's system with a numbered filename and .jpg extension. Screen captures are taken at specified intervals based on the system.

Octopus can capture screenshots of the victims’ machine.

Socksbot can take screenshots.