Procedure examples

LightSpy uses Apple's built-in AVFoundation Framework library to access the user's camera and screen. It uses the `AVCaptureStillImage` to take a picture using the user's camera and the `AVCaptureScreen` to take a screenshot or record the user's screen for a specified period of time.

KeyBoy has a command to perform screen grabbing.

HyperBro has the ability to take screenshots.

Pteranodon can capture screenshots at a configurable interval.

ROKRAT can capture screenshots of the infected system using the `gdi32` library.

PlugX allows the operator to capture screenshots.

Lumma Stealer has taken screenshots of victim machines.

DustySky captures PNG screenshots of the main screen.

Rover takes screenshots of the compromised system's desktop and saves them to C:\system\screenshot.bmp for exfiltration every 60 minutes.

Peppy can take screenshots on targeted systems.

Clambling has the ability to capture screenshots.

SVCReady can take a screenshot from an infected host.

Carbanak performs desktop video recording and captures screenshots of the desktop and sends it to the C2 server.

Hydraq includes a component based on the code of VNC that can stream a live feed of the desktop of an infected host.

Chaes can capture screenshots of the infected machine.

LODEINFO has the ability to take screenshots.

CharmPower has the ability to capture screenshots.

SMOKEDHAM can capture screenshots of the victim’s desktop.

Metamorfo can collect screenshots of the victim’s machine.

Trojan.Karagany can take a desktop screenshot and save the file into \ProgramData\Mail\MailAg\shot.png.

Bandook is capable of taking an image of and uploading the current desktop.

KONNI can take screenshots of the victim’s machine.

T9000 can take screenshots of the desktop and target application windows, saving them to user directories as one byte XOR encrypted .dat files.

gh0st RAT can capture the victim’s screen remotely.

A JHUHUGIT variant takes screenshots by simulating the user pressing the "Take Screenshot" key (VK_SCREENSHOT), accessing the screenshot saved in the clipboard, and converting it to a JPG image.

BLUELIGHT has captured a screenshot of the display every 30 seconds for the first 5 minutes after initiating a C2 loop, and then once every five minutes thereafter.

Micropsia takes screenshots every 90 seconds by calling the Gdi32.BitBlt API.

RedLine Stealer can capture screenshots on a compromised host.

Catchamas captures screenshots based on specific keywords in the window’s title.

StoneDrill can take screenshots.

RogueRobin has a command named $screenshot that may be responsible for taking screenshots of the victim machine.

Attor's has a plugin that captures screenshots of the target applications.

LitePower can take system screenshots and save them to `%AppData%`.

NightClub can load a module to call `CreateCompatibleDC` and `GdipSaveImageToStream` for screen capture.

RTM can capture screenshots.

Derusbi is capable of performing screen captures.

BadPatch captures screenshots in .jpg format and then exfiltrates them.

XLoader can capture screenshots on compromised hosts.

A variant of Zebrocy captures screenshots of the victim’s machine in JPEG and BMP format.

FinFisher takes a screenshot of the screen and displays it on top of all other windows for few seconds in an apparent attempt to hide some messages showed by the system during the setup process.

LunarMail can capture screenshots from compromised hosts.

CrossRAT is capable of taking screen captures.

Cadelspy has the ability to capture screenshots and webcam photos.

Cobalt Strike's Beacon payload is capable of capturing screenshots.

Cobian RAT has a feature to perform screen capture.

HotCroissant has the ability to do real time screen viewing on an infected host.

Valak has the ability to take screenshots on a compromised host.

Kivars has the ability to capture screenshots on the infected host.

TajMahal has the ability to take screenshots on an infected host including capturing content from windows of instant messaging applications.

Raccoon Stealer can capture screenshots from victim systems.