{
  "family": "perflogger",
  "sample_count": 11,
  "category": "trojan",
  "description": "Spyware:Win32/Perflogger is a covert surveillance tool and keylogger designed to secretly record user activity, capture keystrokes, monitor clipboard contents, and exfiltrate sensitive data (such as passwords, financial details, and personal communications) to a remote attacker.<br><br><b>Understanding Perflogger</b><br>To the victim, Perflogger operates entirely invisibly, with no outward signs of infection aside from a potential, minor decrease in system performance. For security analysts, a keylogger represents an immediate and total compromise of user credentials and sensitive data. Perflogger is often deployed as a secondary payload by a dropper trojan, or installed manually by an attacker who has already gained initial access.<br><br><b>Execution and Data Capture Mechanics</b><br>Perflogger typically establishes persistence via Registry Run keys (`T1547.001`) to ensure it starts immediately upon user login. To capture data, it relies heavily on native Windows API hooking. It utilizes `SetWindowsHookEx` to intercept keyboard input globally across all applications (`T1056.001`). It may also periodically capture screenshots (`T1113`) and monitor the system clipboard for copied passwords (`T1115`). The stolen data is temporarily stored locally in hidden, encrypted log files (`T1005`) before being bundled and exfiltrated to a C2 server via FTP, SMTP (email), or HTTP POST requests (`T1041`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is identity theft, credential compromise, and data breach. Incident responders should monitor EDR for suspicious processes injecting DLLs to hook input APIs, or processes frequently reading the clipboard. A strong IoC is an unknown executable in `%AppData%` generating small, steadily growing, heavily obfuscated log files and occasionally sending them outbound over FTP or SMTP.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1115",
    "T1056.001",
    "T1113",
    "T1547.001",
    "T1041"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Credential Access"
    },
    {
      "id": "T1115",
      "name": "Clipboard Data",
      "tactic": "Collection"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel (FTP/SMTP)",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Assume all passwords typed on the infected machine, as well as all active session cookies, have been compromised. Enforce immediate resets.",
    "Isolate the endpoint from the network to halt the active exfiltration of the recorded keylog files.",
    "Use EDR to track down the hidden executable responsible for the hooking, and locate the local staging directory where the keylogs are stored.",
    "Terminate the keylogger process and remove its persistence mechanisms from the Registry."
  ],
  "what_to_avoid": [
    "Do not assume Multi-Factor Authentication (MFA) will fully protect the user; keyloggers often capture the MFA tokens as they are typed, and some capture session cookies.",
    "Avoid delaying the password reset process; the data is usually exfiltrated rapidly."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}