Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Component Library
The UMBRAGE team maintains a library of application development techniques borrowed from in-the-wild malware. The goal of this repository is to provide functional code snippets that can be rapidly combined into custom solutions. Rather than building feature-rich tools, which are often costly and can have significant CI value, this effort focuses on developing smaller and more targeted solutions built to operational specifications.
This page organizes this collection based on its functionality and captures relevant technical information. When possible, each item should include a working example of the technique (and/or pointer to code in the SVN repository), documentation describing application of the technique, and notes concerning our use of these techniques in delivered tools.
| Data Collection Components | Component Reuse | Source |
|---|---|---|
| DirectInput Keylogger | None | Known Malware |
| Internet Explorer Password Collection | None | Known Malware |
| SetWindowsHookEx WH_KEYBOARD and WH_KEYBOARD_LL Key Logger | UNKL 1.0/2.x | Known Malware |
| Webcam Capture | None | Known Malware/Public Samples |
| Windows API Keyloggers | None | Known Malware |