Procedure examples

MESSAGETAP checks for the existence of two configuration files (keyword_parm.txt and parm.txt) and attempts to read the files every 30 seconds.

SUGARDUMP can search for and collect data from specific Chrome, Opera, Microsoft Edge, and Firefox files, including any folders that have the string `Profile` in its name.

SOUNDBITE is capable of enumerating and manipulating files and directories.

MoonWind has a command to return a directory listing for a specified directory.

Ryuk has enumerated files and folders on all mounted drives.

Cryptoistic can scan a directory to identify files for deletion.

HermeticWiper can enumerate common folders such as My Documents, Desktop, and AppData.

ccf32 can parse collected files to identify specific file extensions.

LockBit 2.0 can exclude files associated with core system functions from encryption.

Zebrocy searches for files that are 60mb and less and contain the following extensions: .doc, .docx, .xls, .xlsx, .ppt, .pptx, .exe, .zip, and .rar. Zebrocy also runs the echo %APPDATA% command to list the contents of the directory. Zebrocy can obtain the current execution path as well as perform drive enumeration.

FinFisher enumerates directories and scans for certain files.

LunarMail can search its staging directory for output files it has produced.

CrossRAT can list all files on a system.

OwaAuth has a command to list its directory and logical drives.

Cobalt Strike can explore files on a compromised system.

SUNBURST had commands to enumerate files and directories.

HotCroissant has the ability to retrieve a list of files in a given directory as well as drives and drive types.

REvil has the ability to identify specific files and directories that are not to be encrypted.

Samurai can use a specific module for file enumeration.

PinchDuke searches for files created within a certain timeframe and whose file extension matches a predefined list.

USBStealer searches victim drives for files matching certain extensions (“.skr”,“.pkr” or “.key”) or names.

Taidoor can search for specific files.

Kivars has the ability to list drives on the infected host.

CaddyWiper can enumerate all files and directories on a compromised host.

Cyclops Blink can use the Linux API `statvfs` to enumerate the current working directory.

Seasalt has the capability to identify the drive type on a victim.

TajMahal has the ability to index files from drives, user profiles, and removable drives.

PLEAD has the ability to list drives and files on the compromised host.

Raccoon Stealer identifies target files and directories for collection based on a configuration file.

Cardinal RAT checks its current working directory upon execution and also contains watchdog functionality that ensures its executable is located in the correct path (else it will rewrite the payload).

Pisloader has commands to list drives on the victim machine and to list file information for a given directory.

GoldenSpy has included a program "ExeProtector", which monitors for the existence of GoldenSpy on the infected system and redownloads if necessary.

Gold Dragon lists the directories for Desktop, program files, and the user’s recently accessed files.

Ramsay can collect directory and file lists.

The AshTag AshenOrchestrator component can enumerate files on victim hosts.

MacMa can search for a specific file on the compromised computer and can enumerate files in Desktop, Downloads, and Documents folders.

FunnyDream can identify files with .doc, .docx, .ppt, .pptx, .xls, .xlsx, and .pdf extensions and specific timestamps for collection.

ROADSWEEP can enumerate files on infected devices and avoid encrypting files with .exe, .dll, .sys, .lnk, or . lck extensions.

SUNSPOT enumerated the Orion software Visual Studio solution directory path.

SysUpdate can search files on a compromised host.

OutSteel can search for specific file extensions, including zipped files.

BackConfig has the ability to identify folders and files related to previous infections.

ANELLDR can enumerate files in the current directory to search for encrypted payload files.

Kwampirs collects a list of files and directories in C:\ with the command dir /s /a c:\ >> "C:\windows\TEMP\[RANDOM].tmp".

BoomBox can search for specific files and directories on a machine.

LAMEHUG can target directories on victim machines for file collection.

Mango can enumerate the contents of current working or other specified directories.

InnaputRAT enumerates directories and obtains file attributes on a system.

GrimAgent has the ability to enumerate files and directories on a compromised host.

LookBack can retrieve file listings from the victim machine.