Procedure examples

Daserf can take screenshots.

Cardinal RAT can capture screenshots.

BISCUIT has a command to periodically take screenshots of the system.

Ramsay can take screenshots every 30 seconds as well as when an external removable storage device is connected.

The AshTag AshenOrchestrator component has the ability to take screenshots.

Carberp can capture display screenshots with the screens_dll.dll plugin.

NKAbuse can take screenshots of the victim machine.

Revenge RAT has a plugin for screen capture.

MacMa has used Apple’s Core Graphic APIs, such as `CGWindowListCreateImageFromArray`, to capture the user's screen and open windows.

The FunnyDream ScreenCap component can take screenshots on a compromised host.

SysUpdate has the ability to capture screenshots.

TinyZBot contains screen capture functionality.

Proton captures the content of the desktop with the screencapture binary.

LookBack can take desktop screenshots.

PoetRAT has the ability to take screen captures.

CHOPSTICK has the capability to capture screenshots.

ZxShell can capture screenshots.

Cannon can take a screenshot of the desktop.

Troll Stealer can capture screenshots from victim machines.

njRAT can capture screenshots of the victim’s machines.

TURNEDUP is capable of taking screenshots.

Manjusaka can take screenshots of the victim desktop.

metaMain can take and save screenshots.

XCSSET saves a screen capture of the victim's system with a numbered filename and .jpg extension. Screen captures are taken at specified intervals based on the system.

Octopus can capture screenshots of the victims’ machine.

Socksbot can take screenshots.

Agent Tesla can capture screenshots of the victim’s desktop.

POWERSTATS can retrieve screenshots from compromised hosts.

ECCENTRICBANDWAGON can capture screenshots and store them locally.

BADNEWS has a command to take a screenshot and send it to the C2 server.

Remexi takes screenshots of windows of interest.

jRAT has the capability to take screenshots of the victim’s machine.

MacSpy can capture screenshots of the desktop over multiple monitors.

Lizar can take JPEG screenshots of an infected system. Lizar has also used a plugin to take a screenshot of the infected system.

Azorult can capture screenshots of the victim’s machines.

UPPERCUT can capture desktop screenshots in the PNG format and send them to the C2 server.

StrifeWater has the ability to take screen captures.

SLOTHFULMEDIA has taken a screenshot of a victim's desktop, named it "Filter3.jpg", and stored it in the local directory.

RemoteUtilities can take screenshots on a compromised host.

Sliver can take screenshots of the victim’s active display.

SILENTTRINITY can take a screenshot of the current desktop.

PowerSploit's Get-TimedScreenshot Exfiltration module can take screenshots at regular intervals.

Empire is capable of capturing screenshots on Windows and macOS systems.

PcShare can take screen shots of a compromised machine.

AsyncRAT has the ability to view the screen on compromised hosts.

Brute Ratel C4 can take screenshots on compromised hosts.

Remcos takes automated screenshots of the infected machine.

ConnectWise can take screenshots on remote hosts.

Pupy can drop a mouse-logger that will take small screenshots around at each click and then send back to the server.

Quick Assist allows for the remote administrator to take screenshots of the running system.