Procedure examples

HiddenFace can upload files from the victim machine to C2 nodes.

Cryptoistic can retrieve files from the local file system.

MgBot includes modules for collecting files from local systems based on a given set of properties and filenames.

ccf32 can collect files from a compromised host.

Cobalt Strike can collect data from a local system.

SUNBURST collected information from a compromised host.

Samurai can leverage an exfiltration module to download arbitrary files from compromised machines.

PinchDuke collects user files from the compromised host based on predefined file extensions.

Milan can upload files from a compromised host.

OSX_OCEANLOTUS.D has the ability to upload files from a compromised host.

Taidoor can upload data and files from a victim's machine.

Cyclops Blink can upload files from a compromised host.

PoisonIvy creates a backdoor through which remote attackers can steal system information.

TajMahal has the ability to steal documents from the local system including the print spooler queue.

Raccoon Stealer collects data from victim machines based on configuration information received from command and control nodes.

IPsec Helper can identify specific files and folders for follow-on exfiltration.

DanBot can upload files from compromised hosts.

Calisto can collect data from user directories.

Ramsay can collect Microsoft Word documents from the target's file system, as well as .txt, .doc, and .xls files from the Internet Explorer cache.

Pillowmint has collected credit card data using native API functions.

MacMa can collect then exfiltrate files from the compromised system.

FunnyDream can upload files from victims' machines.

SysUpdate can collect information and files from a compromised host.

OutSteel can collect information from a compromised host.

PUNCHTRACK scrapes memory for properly formatted payment card data.

LAMEHUG has the ability to collect system information and files of interest from compromised systems.

GrimAgent can collect data and files from a compromised host.

StealBit can upload data and files to the LockBit victim-shaming site.

ZxShell can transfer files from a compromised host.

SLIGHTPULSE can read files specified on the local system.

SPAWNCHIMERA has extracted the device’s Linux kernel image (vmlinux).

Troll Stealer gathers information from infected systems such as SSH information from the victim's `.ssh` directory. Troll Stealer collects information from local FileZilla installations and Microsoft Sticky Note.

njRAT can collect data from a local system.

IceApple can collect files, passwords, and other data from a compromised host.

metaMain can collect files and system information from a compromised host.

SideTwist has the ability to upload files from a compromised host.

Mis-Type has collected files and data from a compromised host.

XCSSET collects contacts and application data from files in Desktop, Documents, Downloads, Dropbox, and WeChat folders.

Octopus can exfiltrate files from the system using a documents collector tool.

STARWHALE can collect data from an infected local host.

Pcexter can upload files from targeted systems.

Kevin can upload logs and other data from a compromised host.

Pasam creates a backdoor through which remote attackers can retrieve files.

POWERSTATS can upload files from compromised hosts.

When it first starts, BADNEWS crawls the victim's local drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.

Linfo creates a backdoor through which remote attackers can obtain data from local systems.

Goopy has the ability to exfiltrate documents from infected systems.

QakBot can use a variety of commands, including esentutl.exe to steal sensitive data from Internet Explorer and Microsoft Edge, to acquire information that is subsequently exfiltrated.

CookieMiner has retrieved iPhone text messages from iTunes phone backup files.

Gelsemium can collect data from a compromised host.