Procedure examples

USBStealer searches victim drives for files matching certain extensions (“.skr”,“.pkr” or “.key”) or names.

Taidoor can search for specific files.

Kivars has the ability to list drives on the infected host.

CaddyWiper can enumerate all files and directories on a compromised host.

Cyclops Blink can use the Linux API `statvfs` to enumerate the current working directory.

Seasalt has the capability to identify the drive type on a victim.

TajMahal has the ability to index files from drives, user profiles, and removable drives.

PLEAD has the ability to list drives and files on the compromised host.

Raccoon Stealer identifies target files and directories for collection based on a configuration file.

Cardinal RAT checks its current working directory upon execution and also contains watchdog functionality that ensures its executable is located in the correct path (else it will rewrite the payload).

Pisloader has commands to list drives on the victim machine and to list file information for a given directory.

GoldenSpy has included a program "ExeProtector", which monitors for the existence of GoldenSpy on the infected system and redownloads if necessary.

Gold Dragon lists the directories for Desktop, program files, and the user’s recently accessed files.

Ramsay can collect directory and file lists.

The AshTag AshenOrchestrator component can enumerate files on victim hosts.

MacMa can search for a specific file on the compromised computer and can enumerate files in Desktop, Downloads, and Documents folders.

FunnyDream can identify files with .doc, .docx, .ppt, .pptx, .xls, .xlsx, and .pdf extensions and specific timestamps for collection.

ROADSWEEP can enumerate files on infected devices and avoid encrypting files with .exe, .dll, .sys, .lnk, or . lck extensions.

SUNSPOT enumerated the Orion software Visual Studio solution directory path.

SysUpdate can search files on a compromised host.

OutSteel can search for specific file extensions, including zipped files.

BackConfig has the ability to identify folders and files related to previous infections.

ANELLDR can enumerate files in the current directory to search for encrypted payload files.

Kwampirs collects a list of files and directories in C:\ with the command dir /s /a c:\ >> "C:\windows\TEMP\[RANDOM].tmp".

BoomBox can search for specific files and directories on a machine.

LAMEHUG can target directories on victim machines for file collection.

Mango can enumerate the contents of current working or other specified directories.

InnaputRAT enumerates directories and obtains file attributes on a system.

GrimAgent has the ability to enumerate files and directories on a compromised host.

LookBack can retrieve file listings from the victim machine.

Clop has searched folders and subfolders for files to encrypt.

Lokibot can search for specific files on an infected host.

PoetRAT has the ability to list files upon receiving the ls command from C2.

An older version of CHOPSTICK has a module that monitors all mounted volumes for files with the extensions .doc, .docx, .pgp, .gpg, .m2f, or .m2o.

StealBit can be configured to exfiltrate specific file types.

ZxShell has a command to open a file manager and explorer on the system.

NDiskMonitor can obtain a list of all files and directories as well as logical drives.

DDKONG lists files on the victim’s machine.

Penquin can use the command code do_vslist to send file names, size, and status to C2.

BabyShark has used dir to search for "programfiles" and "appdata".

Cannon can obtain victim drive information as well as a list of folders in C:\Program Files.

Winnti for Windows can check for the presence of specific files prior to moving to the next phase of execution.

Troll Stealer can enumerate and collect items from local drives and folders.

BLACKCOFFEE has the capability to enumerate files.

Kinsing has used the find command to search for specific files.

njRAT can browse file systems using a file manager module.

ZIPLINE can find and append specific files on Ivanti Connect Secure VPNs based upon received commands.

ChChes collects the victim's %TEMP% directory path and version of Internet Explorer.

Manjusaka can gather information about specific files on the victim system.

The IceApple Directory Lister module can list information about files and directories including creation time, last write time, name, and size.