Procedure examples

BlackEnergy has run a keylogger plug-in on a victim.

XAgentOSX contains keylogging functionality that will monitor for active application windows and write them to the log, it can handle special characters, and it will buffer by default 50 characters before sending them out over the C2 infrastructure.

KeyBoy installs a keylogger for intercepting credentials and keystrokes.

DarkTortilla can download a keylogging module.

ROKRAT can use `SetWindowsHookEx` and `GetKeyNameText` to capture keystrokes.

RunningRAT captures keystrokes and sends them back to the C2 server.

DarkWatchman can track key presses with a keylogger module.

PlugX has a module for capturing keystrokes per process including window titles.

DustySky contains a keylogger.

Remsec contains a keylogger component.

Sykipot contains keylogging functionality to steal passwords.

Explosive has leveraged its keylogging capabilities to gain access to administrator accounts on target servers.

Rover has keylogging functionality.

Peppy can log keystrokes on compromised hosts.

Cuba logs keystrokes via polling by using GetKeyState and VkKeyScan functions.

Clambling can capture keystrokes on a compromised host.

DarkGate will spawn a thread on execution to capture all keyboard events and write them to a predefined log file.

ThiefQuest uses the CGEventTap functions to perform keylogging.

Carbanak logs key strokes for configured processes and sends them back to the C2 server.

LODEINFO can capture keystrokes on targeted systems.

SMOKEDHAM can continuously capture keystrokes.

Metamorfo has a command to launch a keylogger and capture keystrokes on the victim’s machine.

Trojan.Karagany can capture keystrokes on a compromised host.

Bandook contains keylogging capabilities.

KONNI has the capability to perform keylogging.

gh0st RAT has a keylogger.

KGH_SPY can perform keylogging by polling the GetAsyncKeyState() function.

Micropsia has keylogging capabilities.

Catchamas collects keystrokes from the victim’s machine.

One of Attor's plugins can collect user credentials via capturing keystrokes and can capture keystrokes pressed within the window of the injected process.

NightClub can use a plugin for keylogging.

RTM can record keystrokes from both the keyboard and virtual keyboard.

Derusbi is capable of logging keystrokes.

Grandoreiro can log keystrokes on the victim's machine.

BadPatch has a keylogging capability.

XLoader can capture keystrokes from the victim machine.

MoonWind has a keylogger.

CorKLOG has captured keystrokes.

MgBot includes keylogger payloads focused on the QQ chat application.

OwaAuth captures and DES-encrypts credentials before writing the username and password to a log file, C:\log.txt.

Cadelspy has the ability to log keystrokes on the compromised host.

Cobalt Strike can track key presses with a keylogger module.

Cobian RAT has a feature to perform keylogging on the victim’s machine.

Unknown Logger is capable of recording keystrokes.

Kivars has the ability to initiate keylogging on the infected host.

PoisonIvy contains a keylogger.

NanoCore can perform keylogging on the victim’s machine.

TajMahal has the ability to capture keystrokes on an infected host.

Daserf can log keystrokes.

Cardinal RAT can log keystrokes.