Description

The Remote Desktop or Screen Capture feature in malware provides the attacker with the ability to silently view and control the victim's desktop in real-time. This capability is akin to virtually looking over the victim's shoulder, offering an unfiltered window into the user's activities and data. For the attacker, this offers a multi-faceted advantage: it allows for easy data harvesting, offers clues for further exploitation, and can facilitate lateral movement across a network. Whether the end goal is data theft, corporate espionage, or advanced persistent threats, the ability to capture or control a desktop remotely equips attackers with a potent tool for deepening their intrusion into a compromised system.

Existing Technique

Name	Associated Feature(s)	Has Snippet	Matching Sample
Desktop Screenshot / Streaming	Remote Desktop / Screen Capture		0

Associated with Releases

Version	Origins	Authors	Languages	Release Date
Nuclear RAT 2.1.0	Brazil 🇧🇷	caesar2k	Delphi	Sep, 2007
Bump-Rat 1.2 Beta	France 🇫🇷	Scraniak	Visual Basic 6 (VB6)	Sep, 2007
Poison Ivy 2.3.2	Sweden 🇸🇪	Shapeless	Delphi, MASM	Jan, 2008
ZombieRat 1.2	Romania 🇷🇴	The Bo$$	Assembly, Delphi	Jan, 2008
Turkojan 4	Turkey 🇹🇷	FµNGµ§	Delphi	Feb, 2008
Turkojan 4.0	Turkey 🇹🇷	Fungus	Delphi	Mar, 2008
sharK 3.1 fwb++	Germany 🇩🇪	sNiper109 , rockZ	Visual Basic 6 (VB6)	Mar, 2008
Lost Door 2.2	Tunisia 🇹🇳	OussamiO	Visual Basic 6 (VB6)	May, 2008
Aero 2	Unknown 🏴‍☠️	Gareth	Delphi	Oct, 2008
Stream RAT 1.0	Sweden 🇸🇪	Marjinz	Visual Basic 6 (VB6)	Dec, 2008
Lost Door 3.0 Stable	Tunisia 🇹🇳	OussamiO	Visual Basic 6 (VB6)	Mar, 2009
SynRAT 4.0.1	France 🇫🇷	DarkCoderSc	Delphi	May, 2009
Cerberus 1.0 Beta	United States 🇺🇸, United Kingdom 🇬🇧	Protocol , Steve10120 , 2sly , Sam	Delphi	Aug, 2009
Cerberus 1.01 Beta	United States 🇺🇸, United Kingdom 🇬🇧	Protocol , Steve10120 , 2sly , Sam	Delphi	Aug, 2009
Cerberus 1.02 Beta	United States 🇺🇸, United Kingdom 🇬🇧	Protocol , Steve10120 , 2sly , Sam	Delphi	Aug, 2009
SynRAT 4.3.1-A-1	France 🇫🇷	DarkCoderSc	Assembly, Delphi	Aug, 2009
Apocalypse RAT 1.4	Turkey 🇹🇷	ap0calypse	Delphi	Aug, 2009
Cerberus 1.03.4	United States 🇺🇸, United Kingdom 🇬🇧	Protocol , Steve10120 , 2sly , Sam	Delphi	Sep, 2009
Spy-Net 2.6	Brazil 🇧🇷	Raphael	Delphi	Oct, 2009
DarkComet RAT 1.3	France 🇫🇷	DarkCoderSc	Assembly, Delphi	Nov, 2009
Cerberus 1.03.5 Beta	United States 🇺🇸, United Kingdom 🇬🇧	Protocol , Steve10120 , 2sly , Sam	Delphi	Dec, 2009
DarkComet RAT 2.0 RC4	France 🇫🇷	DarkCoderSc	Delphi	Mar, 2010
CyberGate 1.04.8	United States 🇺🇸	johnyk	Delphi	Apr, 2010
Lost Door 4.3.1	Tunisia 🇹🇳	OussamiO	Visual Basic 6 (VB6)	Apr, 2010
DarkComet RAT 2.0 RC7	France 🇫🇷	DarkCoderSc	Assembly, Delphi	Jun, 2010
Schwarze Sonne 1.0	Unknown 🏴‍☠️, Germany 🇩🇪, Turkey 🇹🇷	ap0calypse , Slayer616 , Counterstrikewi	Delphi	Jun, 2010
Lost Door 5.1	Tunisia 🇹🇳	OussamiO	Visual Basic 6 (VB6)	Oct, 2010
DarkComet RAT 3.0	France 🇫🇷	DarkCoderSc	Assembly, Delphi	Nov, 2010
Coolvibes 1 Update 8	Spain 🇪🇸	Thor	Delphi	May, 2011
Xtreme RAT 2.9	Brazil 🇧🇷	Raphael	Delphi	Jul, 2011
DarkComet RAT 5.3	France 🇫🇷	DarkCoderSc	Assembly, Delphi	Jun, 2012
DarkComet RAT 5.3.1	France 🇫🇷	DarkCoderSc	Assembly, Delphi	Jun, 2012
Bozok 1.4	Germany 🇩🇪, Turkey 🇹🇷	Slayer616	Delphi	Aug, 2013
NjRat 0.7d	Kuwait 🇰🇼	njq8	VB .net	Dec, 2013
Quasar 1.0	Unknown 🏴‍☠️	MaxXor	C#	Aug, 2015
Lost Door 9.2 Aws	Tunisia 🇹🇳	OussamiO	Visual Basic 6 (VB6)	Jan, 2022