Procedure examples

Rising Sun can enumerate information about files from the infected system, including file size, attributes, creation time, last access time, and write time. Rising Sun can enumerate the compilation timestamp of Windows executable files.

NotPetya searches for files ending with dozens of different file extensions prior to encryption.

ShimRat can list directories.

ObliqueRAT has the ability to recursively enumerate files on an infected endpoint.

SHOTPUT has a command to obtain a directory listing.

Avaddon has searched for specific files prior to encryption.

XAgentOSX contains the readFiles function to return a detailed listing (sometimes recursive) of a specified directory. XAgentOSX contains the showBackupIosFolder function to check for IOS device backups by running ls -la ~/Library/Application\ Support/MobileSync/Backup/.

China Chopper's server component can list directory contents.

LightSpy uses the `NSFileManager` to move, create and delete files. LightSpy can also use the assembly `bt` instruction to determine a file's executable permissions.

Cheerscrypt can search for log and VMware-related files with .log, .vmdk, .vmem, .vswp, and .vmsn extensions.

KeyBoy has a command to launch a file browser or explorer on the system.

MiniDuke can enumerate local drives.

Pteranodon identifies files matching certain file extension and copies them to subdirectories it created.

BeaverTail has searched for .ldb and .log files stored in browser extension directories for collection and exfiltration.

ROKRAT has the ability to gather a list of files and directories on the infected system.

Babuk has the ability to enumerate files on a targeted system.

Exbyte enumerates all document files on an infected machine, then creates a summary of these items including filename and directory location prior to exfiltration to cloud hosting services.

DarkWatchman has the ability to enumerate file and folder names.

BlackMould has the ability to find files on the targeted system.

PACEMAKER can parse `/proc/"process_name"/cmdline` to look for the string `dswsd` within the command line.

BBSRAT can list file and directory information.

PlugX has a module to enumerate drives and find files recursively. PlugX has also checked the path from which it is running for specific parameters prior to execution.

Bisonal can retrieve a file listing from the system.

MultiLayer Wiper generates a list of all files and paths on the fixed drives of an infected system, enumerating all files on the system except specific folders defined in a hardcoded list.

DustySky scans the victim for files that contain certain keywords and document types including PDF, DOC, DOCX, XLS, and XLSX, from a list that is obtained from the C2 as a text file. It can also identify logical drives for the infected machine.

Remsec is capable of listing contents of folders on the victim. Remsec also searches for custom network encryption software on victims.

Rover automatically searches for files on local drives based on a predefined list of file extensions.

Epic recursively searches for all .doc files on the system and collects a directory listing of the Desktop, %TEMP%, and %WINDOWS%\Temp directories.

Peppy can identify specific files for exfiltration.

Cuba can enumerate files by using a variety of functions.

DEATHRANSOM can use loop operations to enumerate directories on a compromised host.

Clambling can browse directories on a compromised host.

Akira examines files prior to encryption to determine if they meet requirements for encryption and can be encrypted by the ransomware. These checks are performed through native Windows functions such as GetFileAttributesW.

Some versions of DarkGate search for the hard-coded folder C:\Program Files\e Carte Bleue.

LockBit 3.0 can exclude files associated with core system functions from encryption.

FoggyWeb's loader can check for the FoggyWeb backdoor .pri file on a compromised AD FS server.

Hydraq creates a backdoor through which remote attackers can check for the existence of files, including its own components, as well as retrieve a list of logical drives.

CreepyDrive can specify the local file path to upload files from.

Caterpillar WebShell can search for files in directories.

A variant of Elise executes dir C:\progra~1 when initially run.

USBferry can detect the victim's file or folder list.

WannaCry searches for variety of user files by file extension before encrypting them using RSA and AES, including Office, PDF, image, audio, video, source code, archive/compression format, and key and certificate files.

TSCookie has the ability to discover drive information on the infected host.

Latrodectus can collect desktop filenames.

Saint Bot can search a compromised host for specific files.

LODEINFO has the ability to designate specific files and folders to encryption.

CharmPower can enumerate drives and list the contents of the C: drive on a victim's computer.

TYPEFRAME can search directories for files on the victim’s machine.

3PARA RAT has a command to retrieve metadata for files on disk as well as a command to list the current working directory.

TAINTEDSCRIBE can use DirectoryList to enumerate files in a specified directory.