Procedure examples

DEATHRANSOM can use loop operations to enumerate directories on a compromised host.

Clambling can browse directories on a compromised host.

Akira examines files prior to encryption to determine if they meet requirements for encryption and can be encrypted by the ransomware. These checks are performed through native Windows functions such as GetFileAttributesW.

Some versions of DarkGate search for the hard-coded folder C:\Program Files\e Carte Bleue.

LockBit 3.0 can exclude files associated with core system functions from encryption.

FoggyWeb's loader can check for the FoggyWeb backdoor .pri file on a compromised AD FS server.

Hydraq creates a backdoor through which remote attackers can check for the existence of files, including its own components, as well as retrieve a list of logical drives.

CreepyDrive can specify the local file path to upload files from.

Caterpillar WebShell can search for files in directories.

A variant of Elise executes dir C:\progra~1 when initially run.

USBferry can detect the victim's file or folder list.

WannaCry searches for variety of user files by file extension before encrypting them using RSA and AES, including Office, PDF, image, audio, video, source code, archive/compression format, and key and certificate files.

TSCookie has the ability to discover drive information on the infected host.

Latrodectus can collect desktop filenames.

Saint Bot can search a compromised host for specific files.

LODEINFO has the ability to designate specific files and folders to encryption.

CharmPower can enumerate drives and list the contents of the C: drive on a victim's computer.

TYPEFRAME can search directories for files on the victim’s machine.

3PARA RAT has a command to retrieve metadata for files on disk as well as a command to list the current working directory.

TAINTEDSCRIBE can use DirectoryList to enumerate files in a specified directory.

Royal can identify specific files and directories to exclude from the encryption process.

Uroburos can search for specific files on a compromised system.

Metamorfo has searched the Program Files directories for specific folders and has searched for strings related to its mutexes.

Spica can list filesystem contents on targeted systems.

Embargo has searched for folders, subfolders and other networked or mounted drives for follow on encryption actions. Embargo has also iterated device volumes using `FindFirstVolumeW()` and `FindNextVolumeW()` functions and then calls the `GetVolumePathNamesForVolumeNameW()` function to retrieve a list of drive letters and mounted folder paths for each specified volume.

Trojan.Karagany can enumerate files and directories on a compromised host.

Bandook has a command to list files on a system.

TINYTYPHON searches through the drive containing the OS, then all drive letters C through to Z, for documents matching certain extensions.

A version of KONNI searches for filenames created with a previous version of the malware, suggesting different versions targeted the same victims and the versions may work together.

CORALDECK searches for specified files.

SPACESHIP identifies files and directories for collection by searching for specific file extensions or file modification time.

BLUELIGHT can enumerate files and collect associated metadata.

KGH_SPY can enumerate files and directories on a compromised host.

down_new has the ability to list the directories on a compromised host.

Ixeshe can list file and directory information.

Micropsia can perform a recursive directory listing for all volume drives available on the victim's machine and can also fetch specific files by their paths.

RARSTONE obtains installer properties from Uninstall Registry Key entries to obtain information about installed applications and how to uninstall certain applications.

Black Basta can enumerate specific files for encryption.

4H RAT has the capability to obtain file and directory listings.

Attor has a plugin that enumerates files with specific extensions on all hard disk drives and stores file information in encrypted log files.

MegaCortex can parse the available drives and directories to determine which files to encrypt.

StreamEx has the ability to enumerate drive types.

BoxCaon has searched for files on the system, such as documents located in the desktop folder.

NightClub can use a file monitor to identify .lnk, .doc, .docx, .xls, .xslx, and .pdf files.

Akira _v2 can target specific files and folders for encryption.

SDBbot has the ability to get directory listings or drive information on a compromised host.

RTM can check for specific files and directories associated with virtualization and malware analysis.

Derusbi is capable of obtaining directory, file, and drive listings.

Bazar can enumerate the victim's desktop.

BadPatch searches for files with specific file extensions.