Procedure examples

SVCReady can collect data from an infected host.

FoggyWeb can retrieve configuration data from a compromised AD FS server.

Hydraq creates a backdoor through which remote attackers can read data from files.

CreepyDrive can upload files to C2 from victim machines.

Caterpillar WebShell has a module to collect information from the local database.

USBferry can collect information from an air-gapped host machine.

Latrodectus can collect data from a compromised host using a stealer module.

Saint Bot can collect files and information from a compromised host.

LODEINFO can upload files from infected hosts to the C2.

CharmPower can collect data and files from a compromised host.

GlassWorm has collected local data from a compromised host to include desktop cryptocurrency wallet data, and documents from within Desktop, Documents, and Downloads.

Uroburos can use its `Get` command to exfiltrate specified files from the compromised system.

Bandook can collect local files from the system .

KONNI has stored collected information and discovered processes in a tmp file.

RAPIDPULSE retrieves files from the victim system via encrypted commands sent to the web shell.

DnsSystem can upload files from infected machines after receiving a command with `uploaddd` in the string.

KGH_SPY can send a file containing victim system information to C2.

Ixeshe can collect data from a local system.

RedLine Stealer has collected data stored locally including chat logs and files associated with chat services such as Steam, Discord, and Telegram.

BoxCaon can upload files from a compromised host.

NightClub can use a file monitor to steal specific files from targeted systems.

Crutch can exfiltrate files from compromised systems.

SDBbot has the ability to access the file system on a compromised host.

Hikit can upload files from compromised machines.

WellMail can exfiltrate files from the victim machine.

RawPOS dumps memory from specific processes on a victim system, parses the dumped files, and scrapes them for credit card data.

ZxxZ can collect data from a compromised host.

Drovorub can transfer files from the victim machine.

Shark can upload files to its C2.

Bazar can retrieve information from the infected machine.

BadPatch collects files from the local system that have the following extensions, then prepares them for exfiltration: .xls, .xlsx, .pdf, .mdb, .rar, .zip, .doc, .docx.

HiddenFace can upload files from the victim machine to C2 nodes.

Cryptoistic can retrieve files from the local file system.

MgBot includes modules for collecting files from local systems based on a given set of properties and filenames.

ccf32 can collect files from a compromised host.

Cobalt Strike can collect data from a local system.

SUNBURST collected information from a compromised host.

Samurai can leverage an exfiltration module to download arbitrary files from compromised machines.

PinchDuke collects user files from the compromised host based on predefined file extensions.

Milan can upload files from a compromised host.

OSX_OCEANLOTUS.D has the ability to upload files from a compromised host.

Taidoor can upload data and files from a victim's machine.

Cyclops Blink can upload files from a compromised host.

PoisonIvy creates a backdoor through which remote attackers can steal system information.

TajMahal has the ability to steal documents from the local system including the print spooler queue.

Raccoon Stealer collects data from victim machines based on configuration information received from command and control nodes.

IPsec Helper can identify specific files and folders for follow-on exfiltration.

DanBot can upload files from compromised hosts.

Calisto can collect data from user directories.

Ramsay can collect Microsoft Word documents from the target's file system, as well as .txt, .doc, and .xls files from the Internet Explorer cache.