Procedure examples

MgBot includes modules for dumping and capturing credentials from process memory.

MgBot includes modules for collecting files from local systems based on a given set of properties and filenames.

MgBot includes modules for performing ARP scans of local connected systems.

MgBot includes modules capable of gathering information from USB thumb drives and CD-ROMs on the victim machine given a list of provided criteria.

MgBot includes modules for identifying local users and administrators on victim machines.

MgBot includes modules for performing HTTP and server service scans.

MgBot includes keylogger payloads focused on the QQ chat application.

MgBot includes a module for establishing a process watchdog for itself, identifying if the MgBot process is still running.

MgBot includes modules for identifying local administrator accounts on victim systems.

MgBot includes modules for collecting information on Active Directory domain accounts.

MgBot can capture clipboard data.

MgBot can capture input and output audio streams from infected devices.

MgBot includes a module capable of stealing content from the Tencent QQ database storing user QQ message history on infected devices.

MgBot includes modules for collecting information on local domain users and permissions.

MgBot includes modules that can steal cookies from Firefox, Chrome, and Edge web browsers.

MgBot includes modules for stealing stored credentials from Outlook and Foxmail email client software.

MgBot includes modules for stealing credentials from various browsers and applications, including Chrome, Opera, Firefox, Foxmail, QQBrowser, FileZilla, and WinSCP.