mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
ryan
2.2 KiB
2.2 KiB
| ID | F0002 |
| Objective(s) | Collection, Credential Access |
| Related ATT&CK Techniques | Input Capture: Keylogging (T1056.001, T1417.001) |
| Version | 2.0 |
| Created | 14 August 2020 |
| Last Modified | 31 October 2022 |
Keylogging
Malware captures user keyboard input.
See ATT&CK: Input Capture: Keylogging (T1056.001, T1417.001)
Methods
| Name | ID | Description |
|---|---|---|
| Application Hook | F0002.001 | Keystrokes are captured with an application hook. |
| Polling | F0002.002 | Keystrokes are captured via polling (e.g., user32.GetAsyncKeyState, user32.GetKeyState). |
Malware Examples
| Name | Date | Description |
|---|---|---|
| Hupigon | 2013 | Certain variants of the malware may have keylogging functionality [1] |
| UP007 | 2016 | The malware logs keystrokes to a file [2] |
| BlackEnergy | 2007 | Keylogger plugin allows for collection of keystrokes [3] |
| DarkComet | 2008 | DarkComet can capture keystrokes [4] |
| Poison-Ivy | 2005 | Can capture keystrokes [5] |
References
[1] https://www.f-secure.com/v-descs/backdoor_w32_hupigon.shtml
[2] https://citizenlab.ca/2016/04/between-hong-kong-and-burma/
[3] https://securelist.com/be2-custom-plugins-router-abuse-and-target-profiles/67353/
[4] https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/
[5] https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy