Procedure examples

Rover copies files from removable drives to C:\system.

LightNeuron can store email data in files and directories specified in its configuration, such as C:\Windows\ServiceProfiles\NetworkService\appdata\Local\Temp\.

Elise creates a file in AppData\Local\Microsoft\Windows\Explorer and stores all harvested data in that file.

LODEINFO has collected stolen web cookies locally in the `%TEMP%` folder.

Sagerunex gathers host information and stages it locally as a RAR file prior to exfiltration. Sagerunex stores logged data in an encrypted file located at `%TEMP%/TS_FB56.tmp` during execution.

LP-Notes has stored collected credentials in ` C:\Users\Public\Downloads\lp-notes.txt`.

GlassWorm has staged collected data in a working directory within a temp folder to include `/tmp/ijewf`.

Trojan.Karagany can create directories to store plugin output and stage data for exfiltration.

SPACESHIP identifies files with certain extensions and copies them to a directory in the user's profile.

KGH_SPY can save collected system information to a file named "info" before exfiltration.

Catchamas stores the gathered data from the machine in .db files and .bmp files under four separate locations.

OopsIE stages the output from command execution and collected files in specific folders before exfiltration.

Attor has staged collected data in a central upload directory prior to exfiltration.

BoxCaon has created a working folder for collected files that it sends to the C2 server.

NightClub has copied captured files and keystrokes to the `%TEMP%` directory of compromised hosts.

Crutch has staged stolen files in the C:\AMD\Temp directory.

Data captured by RawPOS is placed in a temporary file under a directory named "memdump".

BadPatch stores collected data in log files before exfiltration.

MESSAGETAP stored targeted SMS messages that matched its target list in CSV files on the compromised system.

SUGARDUMP has stored collected data under `%<malware_execution_folder>%\\CrashLog.txt`.

MoonWind saves information from its keylogging routine as a .zip file in the present working directory.

CorKLOG has stored the captured data in an encrypted file using a 48-character RC4 key.

ccf32 can temporarily store files in a hidden directory on the local host.

Zebrocy stores all collected information in a single file before exfiltration.

LunarMail can create a directory in `%TEMP%\` to stage data prior to exfilration.

SampleCheck5000 can log the output from C2 commands in an encrypted and compressed format on disk prior to exfiltration.

Milan has saved files prior to upload from a compromised host to folders beginning with the characters `a9850d2f`.

USBStealer collects files matching certain criteria from the victim and stores them in a local directory for later exfiltration.

OilBooster can stage files in the `tempFiles` directory for exfiltration.

PoisonIvy stages collected data in a text file.

Carbon creates a base directory that contains the files and folders that are collected.

Calisto uses a hidden directory named .calisto to store data from the victim’s machine before exfiltration.

Gold Dragon stores information gathered from the endpoint in a file named 1.hwp.

Ramsay can stage data prior to exfiltration in %APPDATA%\Microsoft\UserSetting and %APPDATA%\Microsoft\UserSetting\MediaCache.

MacMa has stored collected files locally before exfiltration.

FunnyDream can stage collected information including screen captures and logged keystrokes locally.

PUNCHTRACK aggregates collected data in a tmp file.

LAMEHUG can save collected data and files of interest in `C:\ProgramData\info\` to consolidate for exfiltration.

RIFLESPINE can stage the output from executed C2 commands to a temporary file.

SLIGHTPULSE has piped the output from executed commands to `/tmp/1`.

Troll Stealer encrypts gathered information on victim devices prior to exfiltrating it through command and control infrastructure.

metaMain has stored the collected system files in a working directory.

Mis-Type has temporarily stored collected information to the files `“%AppData%\{Unique Identifier}\HOSTRURKLSR”` and `“%AppData%\{Unique Identifier}\NEWERSSEMP”`.

Octopus has stored collected information in the Application Data directory on a compromised host.

STARWHALE has stored collected data in a file called `stari.txt`.

ECCENTRICBANDWAGON has stored keystrokes and screenshots within the %temp%\GoogleChrome, %temp%\Downloads, and %temp%\TrendMicroUpdate directories.

BADNEWS copies documents under 15MB found on the victim system to is the user's %temp%\SMB\ folder. It also copies files from USB devices to a predefined directory.

DRYHOOK has stored stolen credentials for future use in the temp folder of a victimized Ivanti Connect Secure VPN device, specifically in the file location `/tmp/cmmmap.kumMW`.

Astaroth collects data in a plaintext file named r1.log before exfiltration.

QakBot has stored stolen emails and other data into new folders prior to exfiltration.