Often includes keylogging (recording keystrokes), stealing browser passwords, and capturing screenshots.
While it uses the .mp4 extension, it is frequently an executable (.exe) disguised as a video file to trick users into running it.
It acts as a downloader or dropper . Once executed, it typically communicates with a Command and Control (C2) server to download more dangerous payloads. Behavior:
Often very small (under 1MB) or artificially "padded" to appear larger.
It may copy itself to the %AppData% or %Temp% folders and create a Registry key or Scheduled Task to ensure it runs every time the computer starts.