Procedure examples

FatDuke can copy files and directories from a compromised host.

DRATzarus can collect information from a compromised host.

Rising Sun has collected data and files from a compromised host.

ShimRat has the capability to upload collected files to a C2.

Chrommme can collect data from a local system.

Flagpro can collect data from a compromised host, including Windows authentication information.

SpicyOmelette has collected data and other information from a compromised host.

Green Lambert can collect data from a compromised host.

China Chopper's server component can upload local files.

BeaverTail has exfiltrated data collected from local systems.

ROKRAT can collect host data and specific file types.

DarkWatchman can collect files from a compromised host.

BlackMould can copy files on a compromised host.

Bisonal has collected information from a compromised host.

Rover searches for files on local drives based on a predefined list of file extensions.

LightNeuron can collect files from a local system.

Clambling can collect information from a compromised host.

DarkGate has stolen `sitemanager.xml` and `recentservers.xml` from `%APPDATA%\FileZilla\` if present.

Mongall has the ability to upload files from victim's machines.

SVCReady can collect data from an infected host.

FoggyWeb can retrieve configuration data from a compromised AD FS server.

Hydraq creates a backdoor through which remote attackers can read data from files.

CreepyDrive can upload files to C2 from victim machines.

Caterpillar WebShell has a module to collect information from the local database.

USBferry can collect information from an air-gapped host machine.

Latrodectus can collect data from a compromised host using a stealer module.

Saint Bot can collect files and information from a compromised host.

LODEINFO can upload files from infected hosts to the C2.

CharmPower can collect data and files from a compromised host.

GlassWorm has collected local data from a compromised host to include desktop cryptocurrency wallet data, and documents from within Desktop, Documents, and Downloads.

Uroburos can use its `Get` command to exfiltrate specified files from the compromised system.

Bandook can collect local files from the system .

KONNI has stored collected information and discovered processes in a tmp file.

RAPIDPULSE retrieves files from the victim system via encrypted commands sent to the web shell.

DnsSystem can upload files from infected machines after receiving a command with `uploaddd` in the string.

KGH_SPY can send a file containing victim system information to C2.

Ixeshe can collect data from a local system.

RedLine Stealer has collected data stored locally including chat logs and files associated with chat services such as Steam, Discord, and Telegram.

BoxCaon can upload files from a compromised host.

NightClub can use a file monitor to steal specific files from targeted systems.

Crutch can exfiltrate files from compromised systems.

SDBbot has the ability to access the file system on a compromised host.

Hikit can upload files from compromised machines.

WellMail can exfiltrate files from the victim machine.

RawPOS dumps memory from specific processes on a victim system, parses the dumped files, and scrapes them for credit card data.

ZxxZ can collect data from a compromised host.

Drovorub can transfer files from the victim machine.

Shark can upload files to its C2.

Bazar can retrieve information from the infected machine.

BadPatch collects files from the local system that have the following extensions, then prepares them for exfiltration: .xls, .xlsx, .pdf, .mdb, .rar, .zip, .doc, .docx.