Procedure examples

Bankshot collects files from the local system.

SharpDisco has dropped a recent-files stealer plugin to `C:\Users\Public\WinSrcNT\It11.exe`.

xCaon has uploaded files from victims' machines.

Nebulae has the capability to upload collected files to C2.

RainyDay can use a file exfiltration tool to collect recently changed files on a compromised host.

AppleSeed can collect data on a compromised host.

TinyTurla can upload files from a compromised host.

CosmicDuke steals user files from local hard drives with file extensions that match a predefined list.

EnvyScout can collect sensitive NTLM material from a compromised host.

Crimson can collect information from a compromised host.

Tomiris has the ability to collect recent files matching a hardcoded list of extensions prior to exfiltration.

DUSTTRAP can gather data from infected systems.

Machete searches the File system for files of interest.

PowerLess has the ability to exfiltrate data, including Chrome and Edge browser database files, from compromised machines.

Action RAT can collect local data from an infected machine.

PingPull can collect data from a compromised host.

WellMess can send files from the victim machine to C2.

Woody RAT can collect information from a compromised host.

Mafalda can collect files and information from a compromised host.

AuTo Stealer can collect data such as PowerPoint files, Word documents, Excel files, PDF files, text files, database files, and image files from an infected machine.

SombRAT has collected data and files from a compromised host.

FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on the local system. FLASHFLOOD will scan the My Recent Documents, Desktop, Temporary Internet Files, and TEMP directories. FLASHFLOOD also collects information stored in the Windows Address Book.

FlawedAmmyy has collected information and files from a compromised machine.

LoFiSe can collect files of interest from targeted systems.

MobileOrder exfiltrates data collected from the victim mobile device.

InvisiMole can collect data from the system, and can monitor changes in specified directories.

P.A.S. Webshell has the ability to copy files on a compromised host.

Neoichor can upload files from a victim's machine.

MarkiRAT can upload data from the victim's machine to the C2 server.

Kazuar uploads files from a specified directory to the C2 server.

CHIMNEYSWEEP can collect files from compromised hosts.

FatDuke can copy files and directories from a compromised host.

DRATzarus can collect information from a compromised host.

Rising Sun has collected data and files from a compromised host.

ShimRat has the capability to upload collected files to a C2.

Chrommme can collect data from a local system.

Flagpro can collect data from a compromised host, including Windows authentication information.

SpicyOmelette has collected data and other information from a compromised host.

Green Lambert can collect data from a compromised host.

China Chopper's server component can upload local files.

BeaverTail has exfiltrated data collected from local systems.

ROKRAT can collect host data and specific file types.

DarkWatchman can collect files from a compromised host.

BlackMould can copy files on a compromised host.

Bisonal has collected information from a compromised host.

Rover searches for files on local drives based on a predefined list of file extensions.

LightNeuron can collect files from a local system.

Clambling can collect information from a compromised host.

DarkGate has stolen `sitemanager.xml` and `recentservers.xml` from `%APPDATA%\FileZilla\` if present.

Mongall has the ability to upload files from victim's machines.