Technique:  Screen Capture
Agent Tesla can capture screenshots of the victim’s desktop.
AppleSeed can take screenshots on a compromised host by calling a series of APIs.
It has used tools to take screenshots from victims.
It has used a screen capture utility to take screenshots on a compromised host.
Aria-body has the ability to capture screenshots on compromised hosts.
AsyncRAT has the ability to view the screen on compromised hosts.
Attor's has a plugin that captures screenshots of the target applications.
Azorult can capture screenshots of the victim’s machines.
BADHATCH can take screenshots and send them to an actor-controlled C2 server.
BADNEWS has a command to take a screenshot and send it to the C2 server.
BadPatch captures screenshots in .jpg format and then exfiltrates them.
Bandook is capable of taking an image of and uploading the current desktop.
BISCUIT has a command to periodically take screenshots of the system.
BlackEnergy is capable of taking screenshots.
BLUELIGHT has captured a screenshot of the display every 30 seconds for the first 5 minutes after initiating a C2 loop, and then once every five minutes thereafter.
It has used a tool to capture screenshots.
Brute Ratel C4 can take screenshots on compromised hosts.
Cadelspy has the ability to capture screenshots and webcam photos.
Cannon can take a screenshot of the desktop.
It performs desktop video recording and captures screenshots of the desktop and sends it to the C2 server.
Carberp can capture display screenshots with the screens_dll.dll plugin.
Cardinal RAT can capture screenshots.
Catchamas captures screenshots based on specific keywords in the window’s title.
Chaes can capture screenshots of the infected machine.
CharmPower has the ability to capture screenshots.
CHOPSTICK has the capability to capture screenshots.
Chrommme has the ability to capture screenshots.
Clambling has the ability to capture screenshots.
Cobalt Strike's Beacon payload is capable of capturing screenshots.
Cobian RAT has a feature to perform screen capture.
ConnectWise can take screenshots on remote hosts.
CosmicDuke takes periodic screenshots and exfiltrates them.
Crimson contains a command to perform screen captures.
CrossRAT is capable of taking screen captures.
It took screenshots using their Windows malware.
Daserf can take screenshots.
Derusbi is capable of performing screen captures.
DOGCALL is capable of capturing screenshots of the victim's machine.
It has performed screen captures of victims, including by using a tool, scr.exe (which matched the hash of ScreenUtil).
DustySky captures PNG screenshots of the main screen.
ECCENTRICBANDWAGON can capture screenshots and store them locally.
Empire is capable of capturing screenshots on Windows and macOS systems.
EvilGrab has the capability to capture screenshots.
It captured screenshots and desktop video recordings.
FinFisher takes a screenshot of the screen and displays it on top of all other windows for few seconds in an apparent attempt to hide some messages showed by the system during the setup process.
Flame can take regular screenshots when certain applications are open that are sent to the command and control server.
FlawedAmmyy can capture screenshots.
FruitFly takes screenshots of the user's desktop.
The FunnyDream ScreenCap component can take screenshots on a compromised host.
It's malware can take screenshots of the compromised computer every minute.
gh0st RAT can capture the victim’s screen remotely.
It has used the remote monitoring and management tool ConnectWise to obtain screen captures from victim's machines.
GRIFFON has used a screenshot module that can be used to take a screenshot of the remote system.
Malware used by It is capable of watching the victim's screen.
HALFBAKED can obtain screenshots from the victim.
HotCroissant has the ability to do real time screen viewing on an infected host.
Hydraq includes a component based on the code of VNC that can stream a live feed of the desktop of an infected host.
HyperBro has the ability to take screenshots.
InvisiMole can capture screenshots of not only the entire screen, but of each separate window open, in case they are overlapping.
Janicab captured screenshots and sent them out to a C2 server.
A JHUHUGIT variant takes screenshots by simulating the user pressing the "Take Screenshot" key (VK_SCREENSHOT), accessing the screenshot saved in the clipboard, and converting it to a JPG image.
jRAT has the capability to take screenshots of the victim’s machine.
Kasidet has the ability to initiate keylogging and screen captures.
Kazuar captures screenshots of the victim’s screen.
KeyBoy has a command to perform screen grabbing.
KEYMARBLE can capture screenshots of the victim’s machine.
Kivars has the ability to capture screenshots on the infected host.
KONNI can take screenshots of the victim’s machine.
LitePower can take system screenshots and save them to %AppData%.
Lizar can take JPEG screenshots of an infected system.
LookBack can take desktop screenshots.
It captures screenshots.
MacMa has used Apple’s Core Graphic APIs, such as CGWindowListCreateImageFromArray, to capture the user's screen and open windows.
MacSpy can capture screenshots of the desktop over multiple monitors.
Mafalda can take a screenshot of the target machine and save it to a file.
It malware can take a screenshot and upload the file to its C2 server.
MarkiRAT can capture screenshots that are initially saved as ‘scr.jpg’.
Matryoshka is capable of performing screen captures.
metaMain can take and save screenshots.
Metamorfo can collect screenshots of the victim’s machine.
Micropsia takes screenshots every 90 seconds by calling the Gdi32.BitBlt API.
It has used plugins to take screenshots on targeted systems.
It has used malware that can capture screenshots of the victim’s machine.
NETWIRE can capture the victim's screen.
NightClub can load a module to call CreateCompatibleDC and GdipSaveImageToStream for screen capture.
njRAT can capture screenshots of the victim’s machines.
ObliqueRAT can capture a screenshot of the current screen.
Octopus can capture screenshots of the victims’ machine.
It has a tool called CANDYKING to capture a screenshot of user's desktop.
PcShare can take screen shots of a compromised machine.
Peppy can take screenshots on targeted systems.
PlugX allows the operator to capture screenshots.
PoetRAT has the ability to take screen captures.
POORAIM can perform screen capturing.
PowerSploit's Get-TimedScreenshot Exfiltration module can take screenshots at regular intervals.
POWERSTATS can retrieve screenshots from compromised hosts.
POWRUNER can capture a screenshot from a victim.
Prikormka contains a module that captures screenshots of the victim's desktop.
Proton captures the content of the desktop with the screencapture binary.
Pteranodon can capture screenshots at a configurable interval.
Pupy can drop a mouse-logger that will take small screenshots around at each click and then send back to the server.
QuietSieve has taken screenshots every five minutes and saved them to the user's local Application Data folder under Temp\SymbolSourceSymbols\icons or Temp\ModeAuto\icons.
RainyDay has the ability to capture screenshots.
Ramsay can take screenshots every 30 seconds as well as when an external removable storage device is connected.
RCSession can capture screenshots from a compromised host.
RDAT can take a screenshot on the infected system.
RedLeaves can capture screenshots.
Remcos takes automated screenshots of the infected machine.
Remexi takes screenshots of windows of interest.
RemoteUtilities can take screenshots on a compromised host.
Revenge RAT has a plugin for screen capture.
RogueRobin has a command named $screenshot that may be responsible for taking screenshots of the victim machine.
ROKRAT can capture screenshots of the infected system using the gdi32 library.
Rover takes screenshots of the compromised system's desktop and saves them to C:\system\screenshot.bmp for exfiltration every 60 minutes.
It can capture screenshots.
SharpStage has the ability to capture the victim's screen.
SHUTTERSPEED can capture screenshots.
It can capture victim screen activity.
SILENTTRINITY can take a screenshot of the current desktop.
Sliver can take screenshots of the victim’s active display.
SLOTHFULMEDIA has taken a screenshot of a victim's desktop, named it "Filter3.jpg", and stored it in the local directory.
SMOKEDHAM can capture screenshots of the victim’s desktop.
Socksbot can take screenshots.
StoneDrill can take screenshots.
StrifeWater has the ability to take screen captures.
SVCReady can take a screenshot from an infected host.
SysUpdate has the ability to capture screenshots.
T9000 can take screenshots of the desktop and target application windows, saving them to user directories as one byte XOR encrypted .dat files.
TajMahal has the ability to take screenshots on an infected host including capturing content from windows of instant messaging applications.
TinyZBot contains screen capture functionality.
Trojan.Karagany can take a desktop screenshot and save the file into \ProgramData\Mail\MailAg\shot.png.
Turian has the ability to take screenshots.
TURNEDUP is capable of taking screenshots.
UPPERCUT can capture desktop screenshots in the PNG format and send them to the C2 server.
Ursnif has used hooked APIs to take screenshots.
Valak has the ability to take screenshots on a compromised host.
VERMIN can perform screen captures of the victim’s machine.
Woody RAT has the ability to take a screenshot of the infected host desktop using Windows GDI+.
XAgentOSX contains the takeScreenShot (along with startTakeScreenShot and stopTakeScreenShot) functions to take screenshots using the CGGetActiveDisplayList, CGDisplayCreateImage, and NSImage:initWithCGImage methods.
XCSSET saves a screen capture of the victim's system with a numbered filename and .jpg extension. Screen captures are taken at specified intervals based on the system.
yty collects screenshots of the victim machine.
A variant of Zebrocy captures screenshots of the victim’s machine in JPEG and BMP format.
Zeus Panda can take screenshots of the victim’s machine.
ZLib has the ability to obtain screenshots of the compromised system.
ZxShell can capture screenshots.