Procedure examples

Lumma Stealer has harvested cookies from various browsers.

DarkGate attempts to steal Opera cookies, if present, after terminating the related process.

Chaes has used a script that extracts the web session cookie and sends it to the C2 server.

LODEINFO can list the contents of `%LocalAppData%\Google\Chrome\User Data\` and `%LocalAppData%\Microsoft\Edge\User Data\` to obtain cookies.

EVILNUM can harvest cookies and upload them to the C2 server.

GlassWorm has harvested Safari cookies stored within `/Library/Containers/com.apple.Safari/Data/Library/Cookies/ Cookies.binarycookies`. GlassWorm has also stolen cookies within Chromium and Firefox browsers.

Spica has the ability to steal cookies from Chrome, Firefox, Opera, and Edge browsers.

BLUELIGHT can harvest cookies from Internet Explorer, Edge, Chrome, and Naver Whale browsers.

RedLine Stealer has stolen browser cookies and settings.

Grandoreiro can steal the victim's cookies to use for duplicating the active session from another device.

XLoader can capture web session cookies and session information from victim browsers.

MgBot includes modules that can steal cookies from Firefox, Chrome, and Edge web browsers.

TajMahal has the ability to steal web session cookies from Internet Explorer, Netscape Navigator, FireFox and RealNetworks applications.

Raccoon Stealer attempts to steal cookies and related information in browser history.

XCSSET uses scp to access the ~/Library/Cookies/Cookies.binarycookies file.

QakBot has the ability to capture web session cookies.

CookieMiner can steal Google Chrome and Apple Safari browser cookies from the victim’s machine.

evilginx2 can collect information on each session with a victim including the session cookie.

Kali365 has captured session cookies and related session artifacts when the interacted phishing lure acts as proxy for legitimate requests with login services.

Hacking Team UEFI Rootkit is a UEFI BIOS rootkit developed by the company Hacking Team to persist remote access software on some targeted systems.

LoJax is a UEFI BIOS rootkit deployed to persist remote access software on some targeted systems.

Trojan.Mebromi performs BIOS modification and can download and execute a file as well as protect itself from removal.

Equation is known to have the capability to overwrite the firmware on hard drives from some manufacturers.

Cyclops Blink has maintained persistence by patching legitimate device firmware when it is downloaded, including that of WatchGuard devices.

APT41 deployed Master Boot Record bootkits on Windows systems to hide their malware and maintain persistence on victim systems.

APT28 has deployed a bootkit along with Downdelph to ensure its persistence on the victim. The bootkit shares code with some variants of BlackEnergy.

Lazarus Group malware WhiskeyAlfa-Three modifies sector 0 of the Master Boot Record (MBR) to ensure that the malware will persist even if a victim machine shuts down.

TrickBot can implant malicious code into a compromised device's firmware.

WhisperGate overwrites the MBR with a bootloader component that performs destructive wiping operations on hard drives and displays a fake ransom note when the host boots.

Some FinFisher variants incorporate an MBR rootkit.

Carberp has installed a bootkit on the system to maintain persistence.

ROCKBOOT is a Master Boot Record (MBR) bootkit that uses the MBR to establish persistence.

BOOTRASH is a Volume Boot Record (VBR) bootkit that uses the VBR to maintain persistence.

BRICKSTORM has created a new background session and has spawned a child process of a parent process when it determines it is not running in its intended state.

Exaramel for Linux has a hardcoded location that it uses to achieve persistence if the startup system is Upstart or System V and it is running as root.

LITTLELAMB.WOOLTEA can initialize itself as a daemon to run persistently in the background.

IMAPLoader modifies Windows tasks on the victim machine to reference a retrieved PE file through a path modification.

BOLDMOVE can free all resources and terminate itself on victim machines.

Akira _v2 can create a child process for encryption.

LunarMail can create an arbitrary process with a specified command line and redirect its output to a staging directory.

CanisterWorm can establish persistence in CI/CD environments by launching a background process (deploy.js) with stolen tokens.

Contagious Interview has established persistence using InvisibleFerret malware to create file to run the script on Startup via LaunchAgents. Contagious Interview has also utilized a plist file located in `/Library/LaunchAgents` to enable a malicious bash script the ability to persist.

InvisibleFerret has established persistence using LaunchAgents on macOS that run on Startup using a file named “com.avatar.update.wake.plist”.

macOS.OSAMiner has placed a Stripped Payloads with a `plist` extension in the Launch Agent's folder.

NETWIRE can use launch agents for persistence.

Dacls can establish persistence via a LaunchAgent.

Cuckoo Stealer can achieve persistence by creating launch agents to repeatedly execute malicious payloads.

FruitFly persists via a Launch Agent.

Keydnap uses a Launch Agent to persist.

Green Lambert can create a Launch Agent with the `RunAtLoad` key-value pair set to true, ensuring the `com.apple.GrowlHelper.plist` file runs every time a user logs in.