Procedure examples

Bandook has a command to list files on a system.

TINYTYPHON searches through the drive containing the OS, then all drive letters C through to Z, for documents matching certain extensions.

A version of KONNI searches for filenames created with a previous version of the malware, suggesting different versions targeted the same victims and the versions may work together.

CORALDECK searches for specified files.

SPACESHIP identifies files and directories for collection by searching for specific file extensions or file modification time.

BLUELIGHT can enumerate files and collect associated metadata.

KGH_SPY can enumerate files and directories on a compromised host.

down_new has the ability to list the directories on a compromised host.

Ixeshe can list file and directory information.

Micropsia can perform a recursive directory listing for all volume drives available on the victim's machine and can also fetch specific files by their paths.

RARSTONE obtains installer properties from Uninstall Registry Key entries to obtain information about installed applications and how to uninstall certain applications.

Black Basta can enumerate specific files for encryption.

4H RAT has the capability to obtain file and directory listings.

Attor has a plugin that enumerates files with specific extensions on all hard disk drives and stores file information in encrypted log files.

MegaCortex can parse the available drives and directories to determine which files to encrypt.

StreamEx has the ability to enumerate drive types.

BoxCaon has searched for files on the system, such as documents located in the desktop folder.

NightClub can use a file monitor to identify .lnk, .doc, .docx, .xls, .xslx, and .pdf files.

Akira _v2 can target specific files and folders for encryption.

SDBbot has the ability to get directory listings or drive information on a compromised host.

RTM can check for specific files and directories associated with virtualization and malware analysis.

Derusbi is capable of obtaining directory, file, and drive listings.

Bazar can enumerate the victim's desktop.

BadPatch searches for files with specific file extensions.

MESSAGETAP checks for the existence of two configuration files (keyword_parm.txt and parm.txt) and attempts to read the files every 30 seconds.

SUGARDUMP can search for and collect data from specific Chrome, Opera, Microsoft Edge, and Firefox files, including any folders that have the string `Profile` in its name.

SOUNDBITE is capable of enumerating and manipulating files and directories.

MoonWind has a command to return a directory listing for a specified directory.

Ryuk has enumerated files and folders on all mounted drives.

Cryptoistic can scan a directory to identify files for deletion.

HermeticWiper can enumerate common folders such as My Documents, Desktop, and AppData.

ccf32 can parse collected files to identify specific file extensions.

LockBit 2.0 can exclude files associated with core system functions from encryption.

Zebrocy searches for files that are 60mb and less and contain the following extensions: .doc, .docx, .xls, .xlsx, .ppt, .pptx, .exe, .zip, and .rar. Zebrocy also runs the echo %APPDATA% command to list the contents of the directory. Zebrocy can obtain the current execution path as well as perform drive enumeration.

FinFisher enumerates directories and scans for certain files.

LunarMail can search its staging directory for output files it has produced.

CrossRAT can list all files on a system.

OwaAuth has a command to list its directory and logical drives.

Cobalt Strike can explore files on a compromised system.

SUNBURST had commands to enumerate files and directories.

HotCroissant has the ability to retrieve a list of files in a given directory as well as drives and drive types.

REvil has the ability to identify specific files and directories that are not to be encrypted.

Samurai can use a specific module for file enumeration.

PinchDuke searches for files created within a certain timeframe and whose file extension matches a predefined list.

USBStealer searches victim drives for files matching certain extensions (“.skr”,“.pkr” or “.key”) or names.

Taidoor can search for specific files.

Kivars has the ability to list drives on the infected host.

CaddyWiper can enumerate all files and directories on a compromised host.

Cyclops Blink can use the Linux API `statvfs` to enumerate the current working directory.

Seasalt has the capability to identify the drive type on a victim.