Procedure examples

Clop has searched folders and subfolders for files to encrypt.

Lokibot can search for specific files on an infected host.

PoetRAT has the ability to list files upon receiving the ls command from C2.

An older version of CHOPSTICK has a module that monitors all mounted volumes for files with the extensions .doc, .docx, .pgp, .gpg, .m2f, or .m2o.

StealBit can be configured to exfiltrate specific file types.

ZxShell has a command to open a file manager and explorer on the system.

NDiskMonitor can obtain a list of all files and directories as well as logical drives.

DDKONG lists files on the victim’s machine.

Penquin can use the command code do_vslist to send file names, size, and status to C2.

BabyShark has used dir to search for "programfiles" and "appdata".

Cannon can obtain victim drive information as well as a list of folders in C:\Program Files.

Winnti for Windows can check for the presence of specific files prior to moving to the next phase of execution.

Troll Stealer can enumerate and collect items from local drives and folders.

BLACKCOFFEE has the capability to enumerate files.

Kinsing has used the find command to search for specific files.

njRAT can browse file systems using a file manager module.

ZIPLINE can find and append specific files on Ivanti Connect Secure VPNs based upon received commands.

ChChes collects the victim's %TEMP% directory path and version of Internet Explorer.

Manjusaka can gather information about specific files on the victim system.

The IceApple Directory Lister module can list information about files and directories including creation time, last write time, name, and size.

JPIN can enumerate drives and their types. It can also change file permissions using cacls.exe.

metaMain can recursively enumerate files in an operator-provided directory.

SideTwist has the ability to search for specific files.

Psylo has commands to enumerate all storage devices and to find all files that start with a particular string.

Heyoka Backdoor has the ability to search the compromised host for files.

HTTPBrowser is capable of listing files, folders, and drives on a victim.

LunarWeb has the ability to retrieve directory listings.

XCSSET has used `mdfind` to enumerate a list of apps known to grant screen sharing permissions and leverages a module to run the command `ls -la ~/Desktop`.

Octopus can collect information on the Windows directory and searches for compressed RAR files on the host.

KillDisk has used the FindNextFile command as part of its file deletion process.

Qilin can exclude specific directories and files from encryption.

SoreFang has the ability to list directories.

Industroyer’s data wiper component enumerates specific files on all the Windows drives.

LazyWiper can specifically target multiple files by extension including: .rar, .tar.gz, .zip, .7z, .json, .bcp, .bak, .gho, .erf, .edb, .onepkg, .pst, and .ldiff.

Pcexter has the ability to search for files in specified directories.

Pasam creates a backdoor through which remote attackers can retrieve lists of files.

BADNEWS identifies files with certain extensions from USB devices, then copies them to a predefined directory.

Linfo creates a backdoor through which remote attackers can list contents of drives and search for files.

Remexi searches for files on the system.

QakBot can identify whether it has been run previously on a host by checking for a specified folder.

CookieMiner has looked for files in the user's home directory with "wallet" in their name using find.

Gelsemium can retrieve data from specific Windows directories, as well as open random files as part of Virtualization/Sandbox Evasion.

jRAT can browse file systems.

OSX/Shlayer has used the command appDir="$(dirname $(dirname "$currentDir"))" and $(dirname "$(pwd -P)") to construct installation paths.

Denis has several commands to search directories for files.

INC Ransomware can receive command line arguments to encrypt specific files and directories.

SplatCloak has used Windows API to identify files associated with Windows Defender and Kaspersky.

FIVEHANDS has the ability to enumerate files on a compromised host in order to encrypt files with specific extensions.

AutoIt backdoor is capable of identifying documents on the victim with the following extensions: .doc; .pdf, .csv, .ppt, .docx, .pst, .xls, .xlsx, .pptx, and .jpeg.

Dtrack can list files on available disk volumes.