Procedure examples

GravityRAT steals files based on an extension list if a USB drive is connected to the system.

AppleSeed can find and collect data from removable media devices.

CosmicDuke steals user files from removable media with file extensions and keywords that match a predefined list.

Aria-body has the ability to collect data from USB devices.

Crimson contains a module to collect data from removable drives.

Machete can find, encrypt, and upload files from fixed and removable drives.

Prikormka contains a module that collects documents with certain extensions from removable media or fixed drives connected via USB.

FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on removable media and copies them to a staging area. The default file types copied would include data copied to the drive by SPACESHIP.

InvisiMole can collect jpeg files from connected MTP devices.

ObliqueRAT has the ability to extract data from removable devices connected to the endpoint.

Remsec has a package that collects documents from any inserted USB sticks.

Explosive can scan all .exe files located in the USB drive.

Rover searches for files on attached removable drives based on a predefined list of file extensions every five seconds.

Crutch can monitor removable drives and exfiltrate files matching a given extension list.

MgBot includes modules capable of gathering information from USB thumb drives and CD-ROMs on the victim machine given a list of provided criteria.

Once a removable media device is inserted back into the first victim, USBStealer collects data from it that was exfiltrated from a second victim.

TajMahal has the ability to steal written CD images and files of interest from previously connected removable drives when they become available again.

Ramsay can collect data from removable media and stage it for exfiltration.

The FunnyDream FilePakMonitor component has the ability to collect files from removable devices.

BADNEWS copies files with certain extensions from USB devices to
a predefined directory.