A keylogger is one of the core features implemented by many malware to exfiltrate interesting data and learn about the victim. Besides the fact that interesting keystrokes can reveal sensitive information (usernames, passwords, IP addresses, hostnames, ...), just by having a look at the text typed on the keyboard, the attacker can profile his target and estimate if it's a juicy one or not.
To follow up on my yesterday diary, Microsoft Windows provides API calls to implement a keylogger via API calls like
In 2019, I wrote a diary about a keylogger in PowerShell. Seeing that Python becomes more and more popular in the Windows eco-system, I searched for some samples. I found one that was published as a PoC already six years ago(!) but still used in the wild today. It was again submitted to VT a few weeks ago (SHA256:fe057c31951304a59ff6a59f58e49373c736e75305dcd0c53391d310337ccb41) and has still a very nice score (only 3/59).
The implementation is Python is extremely easy thanks to the pyHook module:
import pyHook, pythoncom data='' def GetKeyPressedAndSendIt(event): global data if event.Ascii==13: keys='<ENTER>' elif event.Ascii==8: keys='<BACK SPACE>' elif event.Ascii==9: keys='<TAB>' else: keys=chr(event.Ascii) data=data+keys hm = pyHook.HookManager() hm.KeyDown = GetKeyPressedAndSendIt hm.HookKeyboard() pythoncom.PumpMessages(
I performed a quick retro hunt on VT to search for the same kind of script and found only 9 occurences:
As you can see, the peak of submitted samples occurred between mid-January and mid-February.
Xavier Mertens (@xme)
Mar 18th 2021
Mar 18th 2021
3 weeks ago