Procedure examples

Prestige can traverse the file system to discover files to encrypt by identifying specific extensions defined in a hardcoded list.

InvisibleFerret has identified specific directories and files for exfiltration using the `ssh_upload` command which contains subcommands of `.sdira`, `sdir`, `sfile`, `sfinda`, `sfindr`, `sfind`. InvisibleFerret also has the capability to scan and upload files of interest from multiple OS systems through the use of scripts that check file names, file extensions, and avoids certain path names. InvisibleFerret has utilized the `findstr` on Windows or the macOS `find` commands to search for files of interest.

Bankshot searches for files on the victim's machine.

SharpDisco can identify recently opened files by using an LNK format parser to extract the original file path from LNK files found in either `%USERPROFILE%\Recent` (Windows XP) or `%APPDATA%\Microsoft\Windows\Recent` (newer Windows versions) .

StrongPity can parse the hard drive on a compromised host to identify specific file extensions.

WinMM sets a WH_CBT Windows hook to search for and capture files on the victim.

Nebulae can list files and directories on a compromised host.

AuditCred can search through folders and files on the system.

Kasidet has the ability to search for a given filename on a victim.

OceanSalt can extract drive information from the endpoint and search files on the system.

Playcrypt can avoid encrypting files with a .PLAY, .exe, .msi, .dll, .lnk, or .sys file extension.

Brave Prince gathers file and directory information from the victim’s machine.

Medusa Ransomware has searched for files within the victim environment for encryption and exfiltration. Medusa Ransomware has also identified files associated with remote management services.

RainyDay can use a file exfiltration tool to collect recently changed files with specific extensions.

AppleSeed has the ability to search for .txt, .ppt, .hwp, .pdf, and .doc files in specified directories.

NETWIRE has the ability to search for files on the compromised host.

CosmicDuke searches attached and mounted drives for file extensions and keywords that match a predefined list.

Gomir collects information about directory and file structures, including total number of subdirectories, total number of files, and total size of files on infected systems.

Aria-body has the ability to gather metadata from a file and to search for file and directory names.

BOLDMOVE can list information of all files in the system recursively from the root directory or from a specified directory.

Crimson contains commands to list files and directories, as well as search for files matching certain extensions from a defined list.

DUSTTRAP can enumerate files and directories.

DynoWiper has used the Microsoft Windows native `FindFirstFile()` and `FindNextFile()` to recursively enumerate directories and files on the system.

Turian can search for specific files and list directories.

Machete produces file listings in order to search for files to be exfiltrated.

Action RAT has the ability to collect drive and file information on an infected machine.

Avenger has the ability to browse files in directories such as Program Files and the Desktop.

A module in Prikormka collects information about the paths, size, and creation time of files with specific file extensions, but not the actual content of the file.

PingPull can enumerate storage volumes and folder contents of a compromised host.

Dacls can scan directories on a compromised host.

DropBook can collect the names of all files and folders in the Program Files directories.

Woody RAT can list all files and their associated attributes, including filename, type, owner, creation time, last access time, last write time, size, and permissions.

Mafalda can search for files and directories.

ELMER is capable of performing directory listings.

SombRAT can execute enum to enumerate files in storage on a compromised system.

ODAgent can identify the current working directory.

FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on the local system and removable media.

FYAnti can search the C:\Windows\Microsoft.NET\ directory for files of a specified size.

LoFiSe can monitor the file system to identify files less than 6.4 MB in size with file extensions including .doc, .docx, .xls, .xlsx, .ppt, .pptx, .pdf, .rtf, .tif, .odt, .ods, .odp, .eml, and .msg.

HOPLIGHT has been observed enumerating system drives and partitions.

Cuckoo Stealer can search for files associated with specific applications.

MobileOrder has a command to upload to its C2 server information about files on the victim mobile device, including SD card size, installed app list, SMS content, contacts, and calling history.

WastedLocker can enumerate files and directories just prior to encryption.

InvisiMole can list information about files in a directory and recently opened or used documents. InvisiMole can also search for specific files by supplied file mask.

P.A.S. Webshell has the ability to list files and file characteristics including extension, size, ownership, and permissions.

Volgmer can list directories on a victim.

WINERACK can enumerate files and directories.

WhisperGate can locate files based on hardcoded file extensions.

FruitFly looks for specific files and file types.

AcidPour can identify specific files and directories within the Linux operating system corresponding with storage devices for follow-on wiping activity, similar to AcidRain.