Class: Trojan
A malicious program designed to electronically spy on the user’s activities (intercept keyboard input, take screenshots, capture a list of active applications, etc.). The collected information is sent to the cybercriminal by various means, including email, FTP, and HTTP (by sending data in a request).Read more
Platform: Win32
Win32 is an API on Windows NT-based operating systems (Windows XP, Windows 7, etc.) that supports execution of 32-bit applications. One of the most widespread programming platforms in the world.Family: FlyStudio
No family descriptionExamples
C8352527711CFDFE5CE93488C0B038A625769BF253FEE51BE1935037F64F3D78
E5CF24009304A21B9B39DB596B90C07C
94B815E02471A87BD572BA929613B74A
18CED43F04937ECDA407A01556EDBC16
Tactics and Techniques: Mitre*
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.
* © 2025 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.