Application Window Discovery

Aria-body has the ability to identify the titles of running windows on a compromised host.^[1]

Attor can obtain application window titles and then determines which windows to perform Screen Capture on.^[2]

Cadelspy has the ability to identify open windows on the compromised host.^[3]

Catchamas obtains application windows titles and then determines which windows to perform Screen Capture on.^[4]

The discovery modules used with Duqu can collect information on open windows.^[5]

Grandoreiro can identify installed security tools based on window names.^[6]

HotCroissant has the ability to list the names of all open windows on the infected host.^[7]

InvisiMole can enumerate windows and child windows on a compromised host.^[8][9]

Kazuar gathers information about opened windows.^[10]

Lazarus Group malware IndiaIndia obtains and sends to its C2 server the title of the window for each running process. The KilaAlfa keylogger also reports the title of the window in the foreground.^[11][12][13]

Machete saves the window names.^[14]

Metamorfo can enumerate all windows on the victim’s machine.^[15][16]

NetTraveler reports window names along with keylogger information to provide application context.^[17]

NETWIRE can discover and close windows on controlled systems.^[18]

njRAT gathers information about opened windows during the initial infection.^[19]

PLEAD has the ability to list open windows on the compromised host.^[20]

PoisonIvy captures window titles.^[21]

PowerDuke has a command to get text of the current foreground window.^[22]

QakBot has the ability to enumerate windows on a compromised host.^[23]

Remexi has a command to capture active windows on the machine and retrieve window titles.^[24]

SOUNDBITE is capable of enumerating application windows.^[25]

Trojan.Karagany can monitor the titles of open windows to identify specific keywords.^[26]

WINERACK can enumerate active windows.^[27]