{
  "family": "krilog",
  "sample_count": 1,
  "category": "trojan",
  "description": "Spyware:Win32/Krilog (or Keylogger:Win32/Krilog) is a malicious tool designed specifically to capture a user's keystrokes (`T1056.001`), mouse clicks, and sometimes screen contents (`T1113`) without their knowledge or consent. It is a primary tool used by attackers for credential harvesting, corporate espionage, and identity theft.<br><br><b>Understanding Krilog (Keylogger)</b><br>To an end-user, a Krilog infection is entirely invisible; the software is designed specifically to hide its presence while silently recording activity. For a SOC analyst, a keylogger detection implies a total compromise of confidentiality for that host. Every password typed, every email drafted, and every secure portal accessed while the keylogger was active must be considered compromised.<br><br><b>Execution and Data Capture Mechanics</b><br>Krilog is typically dropped by a primary infection vector (like a trojan delivered via malspam). Once active, it uses low-level Windows APIs (such as `SetWindowsHookEx`) to intercept hardware events before they reach the intended application (`T1056.001`). It records these events into a hidden, encrypted log file (often stored in `%Temp%` or `%AppData%`). On a scheduled basis, Krilog bundles this log file and exfiltrates it to the attacker's C2 server (`T1041`), often via SMTP (email), FTP, or HTTP POST.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe credential compromise and data theft. Host-based IoCs include EDR alerts for suspicious API hooking (e.g., a non-standard process injecting hooks into `explorer.exe` or browser processes). The presence of hidden, rapidly growing text or encrypted files in user profile directories is a strong indicator. Network IoCs involve regular, small bursts of outbound traffic (often SMTP or FTP) corresponding to the exfiltration of the keylog files.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1056.001",
    "T1041",
    "T1055"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging (The primary function of the malware)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1055",
      "name": "Process Injection (Injecting hooks into legitimate processes to capture input)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel (Sending the captured logs to the attacker)",
      "tactic": "Exfiltration"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent any further exfiltration of the captured keystrokes.",
    "Assume all passwords typed on this machine since the estimated time of infection are compromised; force immediate password resets across all corporate accounts.",
    "Analyze the exfiltrated log files (if they can be recovered locally) to determine exactly what sensitive data was stolen.",
    "Use EDR or AV to identify and remove the Krilog executable and its associated registry persistence keys."
  ],
  "what_to_avoid": [
    "Do not allow the user to type their new passwords on the infected machine until it has been completely wiped and re-imaged.",
    "Avoid closing the incident after removing the malware; the stolen credentials represent an ongoing threat."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}