Procedure examples

OopsIE stages the output from command execution and collected files in specific folders before exfiltration.

Attor has staged collected data in a central upload directory prior to exfiltration.

BoxCaon has created a working folder for collected files that it sends to the C2 server.

NightClub has copied captured files and keystrokes to the `%TEMP%` directory of compromised hosts.

Crutch has staged stolen files in the C:\AMD\Temp directory.

Data captured by RawPOS is placed in a temporary file under a directory named "memdump".

BadPatch stores collected data in log files before exfiltration.

MESSAGETAP stored targeted SMS messages that matched its target list in CSV files on the compromised system.

SUGARDUMP has stored collected data under `%<malware_execution_folder>%\\CrashLog.txt`.

MoonWind saves information from its keylogging routine as a .zip file in the present working directory.

CorKLOG has stored the captured data in an encrypted file using a 48-character RC4 key.

ccf32 can temporarily store files in a hidden directory on the local host.

Zebrocy stores all collected information in a single file before exfiltration.

LunarMail can create a directory in `%TEMP%\` to stage data prior to exfilration.

SampleCheck5000 can log the output from C2 commands in an encrypted and compressed format on disk prior to exfiltration.

Milan has saved files prior to upload from a compromised host to folders beginning with the characters `a9850d2f`.

USBStealer collects files matching certain criteria from the victim and stores them in a local directory for later exfiltration.

OilBooster can stage files in the `tempFiles` directory for exfiltration.

PoisonIvy stages collected data in a text file.

Carbon creates a base directory that contains the files and folders that are collected.

Calisto uses a hidden directory named .calisto to store data from the victim’s machine before exfiltration.

Gold Dragon stores information gathered from the endpoint in a file named 1.hwp.

Ramsay can stage data prior to exfiltration in %APPDATA%\Microsoft\UserSetting and %APPDATA%\Microsoft\UserSetting\MediaCache.

MacMa has stored collected files locally before exfiltration.

FunnyDream can stage collected information including screen captures and logged keystrokes locally.

PUNCHTRACK aggregates collected data in a tmp file.

LAMEHUG can save collected data and files of interest in `C:\ProgramData\info\` to consolidate for exfiltration.

RIFLESPINE can stage the output from executed C2 commands to a temporary file.

SLIGHTPULSE has piped the output from executed commands to `/tmp/1`.

Troll Stealer encrypts gathered information on victim devices prior to exfiltrating it through command and control infrastructure.

metaMain has stored the collected system files in a working directory.

Mis-Type has temporarily stored collected information to the files `“%AppData%\{Unique Identifier}\HOSTRURKLSR”` and `“%AppData%\{Unique Identifier}\NEWERSSEMP”`.

Octopus has stored collected information in the Application Data directory on a compromised host.

STARWHALE has stored collected data in a file called `stari.txt`.

ECCENTRICBANDWAGON has stored keystrokes and screenshots within the %temp%\GoogleChrome, %temp%\Downloads, and %temp%\TrendMicroUpdate directories.

BADNEWS copies documents under 15MB found on the victim system to is the user's %temp%\SMB\ folder. It also copies files from USB devices to a predefined directory.

DRYHOOK has stored stolen credentials for future use in the temp folder of a victimized Ivanti Connect Secure VPN device, specifically in the file location `/tmp/cmmmap.kumMW`.

Astaroth collects data in a plaintext file named r1.log before exfiltration.

QakBot has stored stolen emails and other data into new folders prior to exfiltration.

Helminth creates folders to store output from batch scripts prior to sending the information to its C2 server.

Dtrack can save collected data to disk, different file formats, and network shares.

SLOWPULSE can write logged ACE credentials to `/home/perl/PAUS.pm` in append mode, using the format string `%s:%s\n`.

ADVSTORESHELL stores output from command execution in a .dat file in the %TEMP% directory.

TeamPCP Cloud Stealer has created a staging file in `/tmp` for collected data.

Modules can be pushed to and executed by Duqu that copy data to a staging area, compress it, and XOR encrypt it.