Procedure examples

TrickBot searches the system for all of the following file extensions: .avi, .mov, .mkv, .mpeg, .mpeg4, .mp4, .mp3, .wav, .ogg, .jpeg, .jpg, .png, .bmp, .gif, .tiff, .ico, .xlsx, and .zip. It can also obtain browsing history, cookies, and plug-in information.

PowerDuke has commands to get the current directory name as well as the size of a file. It also has commands to obtain information about logical drives, drive type, and free space.

BLINDINGCAN can search, read, write, move, and execute files.

Ninja has the ability to enumerate directory content.

QuietSieve can search files on the target host by extension, including doc, docx, xls, rtf, odt, txt, jpg, pdf, rar, zip, and 7z.

SynAck checks its directory location in an attempt to avoid launching in a sandbox.

BRICKSTORM has identified specific files and directories within targeted hosts and systems for modification, execution, collection and exfiltration.

AcidRain identifies specific files and directories in the Linux operating system associated with storage devices.

Amadey has searched for folders associated with antivirus software.

Proxysvc lists files in directories.

Orz can gather victim drive information.

yty gathers information on victim’s drives and has a plugin for document listing.

Backdoor.Oldrea collects information about available drives, default browser, desktop file list, My Documents, Internet history, program files, and root of available drives. It also searches for ICS-related software files.

Stuxnet uses a driver to scan for specific filesystem driver objects.

AvosLocker has searched for files and directories on a compromised network.

POWRUNER may enumerate user directories on a victim.

COATHANGER will survey the contents of system files during installation.

Smoke Loader recursively searches through directories for files.

WindTail has the ability to enumerate the users home directory and the path to its own application bundle.

Misdat is capable of running commands to obtain a list of files and directories, as well as enumerating logical drives.

KEYMARBLE has a command to search for files on the victim’s machine.

ThreatNeedle can obtain file and directory information.

RansomHub has the ability to only encrypt specific files.

ZLib has the ability to enumerate files and drives.

RedLeaves can enumerate and search for files and directories.

LITTLELAMB.WOOLTEA can monitor for system upgrade events by checking for the presence of `/tmp/data/root/dev`.

Zeus Panda searches for specific directories on the victim’s machine.

GeminiDuke collects information from the victim, including installed drivers, programs previously executed by users, programs and services configured to automatically run at startup, files and folders present in any user's home folder, files and folders present in any user's My Documents, programs installed to the Program Files folder, and recently accessed files, folders, and programs.

The Havoc interface can display a file explorer view of the compromised host.

GravityRAT collects the volumes mapped on the system, and also steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.

Prestige can traverse the file system to discover files to encrypt by identifying specific extensions defined in a hardcoded list.

InvisibleFerret has identified specific directories and files for exfiltration using the `ssh_upload` command which contains subcommands of `.sdira`, `sdir`, `sfile`, `sfinda`, `sfindr`, `sfind`. InvisibleFerret also has the capability to scan and upload files of interest from multiple OS systems through the use of scripts that check file names, file extensions, and avoids certain path names. InvisibleFerret has utilized the `findstr` on Windows or the macOS `find` commands to search for files of interest.

Bankshot searches for files on the victim's machine.

SharpDisco can identify recently opened files by using an LNK format parser to extract the original file path from LNK files found in either `%USERPROFILE%\Recent` (Windows XP) or `%APPDATA%\Microsoft\Windows\Recent` (newer Windows versions) .

StrongPity can parse the hard drive on a compromised host to identify specific file extensions.

WinMM sets a WH_CBT Windows hook to search for and capture files on the victim.

Nebulae can list files and directories on a compromised host.

AuditCred can search through folders and files on the system.

Kasidet has the ability to search for a given filename on a victim.

OceanSalt can extract drive information from the endpoint and search files on the system.

Playcrypt can avoid encrypting files with a .PLAY, .exe, .msi, .dll, .lnk, or .sys file extension.

Brave Prince gathers file and directory information from the victim’s machine.

Medusa Ransomware has searched for files within the victim environment for encryption and exfiltration. Medusa Ransomware has also identified files associated with remote management services.

RainyDay can use a file exfiltration tool to collect recently changed files with specific extensions.

AppleSeed has the ability to search for .txt, .ppt, .hwp, .pdf, and .doc files in specified directories.

NETWIRE has the ability to search for files on the compromised host.

CosmicDuke searches attached and mounted drives for file extensions and keywords that match a predefined list.

Gomir collects information about directory and file structures, including total number of subdirectories, total number of files, and total size of files on infected systems.

Aria-body has the ability to gather metadata from a file and to search for file and directory names.

BOLDMOVE can list information of all files in the system recursively from the root directory or from a specified directory.