Procedure examples

Linfo creates a backdoor through which remote attackers can change the frequency at which compromised hosts contact remote C2 infrastructure.

ShadowPad has sent data back to C2 every 8 hours.

jRAT can be configured to reconnect at certain intervals.

ADVSTORESHELL collects, compresses, encrypts, and exfiltrates data to the C2 server every 10 minutes.

AppleSeed has divided files if the size is 0x1000000 bytes or more.

RDAT can upload a file via HTTP POST response to the C2 split into 102,400-byte portions. RDAT can also download data from the C2 which is split into 81,920-byte portions.

ObliqueRAT can break large files of interest into smaller chunks to prepare them for exfiltration.

POSHSPY uploads data in 2048-byte chunks.

Carbanak exfiltrates data in compressed chunks if a message is larger than 4096 bytes .

OopsIE exfiltrates command output and collected files to its C2 server in 1500-byte blocks.

Cobalt Strike will break large data sets into smaller chunks for exfiltration.

Kessel can split the data to be exilftrated into chunks that will fit in subdomains of DNS queries.

StealBit can be configured to exfiltrate files at a specified rate to evade network detection mechanisms.

LunarWeb can split exfiltrated data that exceeds 1.33 MB in size into multiple random sized parts between 384 and 512 KB.

Kevin can exfiltrate data to the C2 server in 27-character chunks.

Helminth splits data into chunks up to 23 bytes and sends the data in DNS queries to its C2 server.

The Rclone "chunker" overlay supports splitting large files in smaller chunks during upload to circumvent size limits.

Mythic supports custom chunk sizes used to upload/download files.

TrickBot can identify the user and groups the user belongs to on a compromised host.

PowerDuke has commands to get the current user's name and SID.

RCSession can gather system owner information, including user and administrator privileges.

Spark has run the whoami command and has a built-in command to identify the user logged in.

SynAck gathers user names from infected hosts.

Bumblebee has the ability to identify the user name.

Amadey has collected the user name from a compromised host using `GetUserNameA`.

NOKKI can collect the username from the victim’s machine.

yty collects the victim’s username.

Backdoor.Oldrea collects the current username from the victim.

IronWind can enumerate the username on victim's systems.

Get2 has the ability to identify the current username of an infected host.

POWRUNER may collect information about the currently logged in user by running whoami on a victim.

KOPILUWAK can conduct basic network reconnaissance on the victim machine with `whoami`, to get user details.

Linux Rabbit opens a socket on port 22 and if it receives a response it attempts to obtain the machine's hostname and Top-Level Domain.

Exaramel for Linux can run whoami to identify the system owner.

HAWKBALL can collect the user name of the system.

RedLeaves can obtain information about the logged on user both locally and for Remote Desktop sessions.

Felismus collects the current username and sends it to the C2 server.

Havoc can trigger exection of `whoami` on the target host to display the current user.

GravityRAT collects the victim username along with other account information (account type, description, full name, SID and status).

InvisibleFerret has identified the user’s UUID and username through the "pay" module.

can collect the victim user name.

WinMM uses NetUser-GetInfo to identify that it is running under an “Admin” account on the local system.

TONESHELL has obtained the username from an infected host.

PyDCrypt has probed victim machines with whoami and has collected the username from the machine.

BOOKWORM has obtained the username from an infected host.

SslMM sends the logged-on username to its hard-coded C2.

Aria-body has the ability to identify the username on a compromised host.

Emotet has enumerated all users connected to network shares.

Crimson can identify the user on a targeted system.

Turian can retrieve usernames.