Procedure examples

TrickBot collects local files and information from the victim’s local machine.

BLINDINGCAN has uploaded files from victim machines.

RCSession can collect data from a compromised host.

QuietSieve can collect files from a compromised host.

Bumblebee can capture and compress stolen credentials from the Registry and volume shadow copies.

BRICKSTORM has commands that allow the actor download files from the compromised host to the C2 server, and to also download specific sections of a file.

Amadey can collect information from a compromised host.

Proxysvc searches the local system and gathers data.

yty collects files with the following extensions: .ppt, .pptx, .pdf, .doc, .docx, .xls, .xlsx, .docm, .rtf, .inp, .xlsm, .csv, .odt, .pps, .vcf and sends them back to the C2 server.

KOPILUWAK can gather information from compromised hosts.

Sardonic has the ability to collect data from a compromised machine to deliver to the attacker.

Misdat has collected files and data from a compromised host.

Ursnif has collected files from victim machines, including certificates and cookies.

CASTLETAP can execute a C2 command to transfer files from victim machines.

ThreatNeedle can collect data and files from a compromised host.

Havoc can download files from the victim's computer.

FrameworkPOS can collect elements related to credit card data from process memory.

GravityRAT steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.

InvisibleFerret has collected data utilizing a script that contained a list of excluded files and directory names and naming patterns of interest such as environment and configuration files, documents, spreadsheets, and other files that contained the words secret, wallet, private, and password.

Bankshot collects files from the local system.

SharpDisco has dropped a recent-files stealer plugin to `C:\Users\Public\WinSrcNT\It11.exe`.

xCaon has uploaded files from victims' machines.

Nebulae has the capability to upload collected files to C2.

RainyDay can use a file exfiltration tool to collect recently changed files on a compromised host.

AppleSeed can collect data on a compromised host.

TinyTurla can upload files from a compromised host.

CosmicDuke steals user files from local hard drives with file extensions that match a predefined list.

EnvyScout can collect sensitive NTLM material from a compromised host.

Crimson can collect information from a compromised host.

Tomiris has the ability to collect recent files matching a hardcoded list of extensions prior to exfiltration.

DUSTTRAP can gather data from infected systems.

Machete searches the File system for files of interest.

PowerLess has the ability to exfiltrate data, including Chrome and Edge browser database files, from compromised machines.

Action RAT can collect local data from an infected machine.

PingPull can collect data from a compromised host.

WellMess can send files from the victim machine to C2.

Woody RAT can collect information from a compromised host.

Mafalda can collect files and information from a compromised host.

AuTo Stealer can collect data such as PowerPoint files, Word documents, Excel files, PDF files, text files, database files, and image files from an infected machine.

SombRAT has collected data and files from a compromised host.

FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on the local system. FLASHFLOOD will scan the My Recent Documents, Desktop, Temporary Internet Files, and TEMP directories. FLASHFLOOD also collects information stored in the Windows Address Book.

FlawedAmmyy has collected information and files from a compromised machine.

LoFiSe can collect files of interest from targeted systems.

MobileOrder exfiltrates data collected from the victim mobile device.

InvisiMole can collect data from the system, and can monitor changes in specified directories.

P.A.S. Webshell has the ability to copy files on a compromised host.

Neoichor can upload files from a victim's machine.

MarkiRAT can upload data from the victim's machine to the C2 server.

Kazuar uploads files from a specified directory to the C2 server.

CHIMNEYSWEEP can collect files from compromised hosts.