Procedure examples

Proxysvc automatically collects data about the victim and sends it to the control server.

Depending on the Linux distribution, RotaJakiro executes a set of commands to collect device information and sends the collected information to the C2 server.

WindTail can identify and add files that possess specific file extensions to an array for archiving.

Bankshot recursively generates a list of files within a directory and sends them back to the control server.

StrongPity has a file searcher component that can automatically collect and archive files based on a predefined list of file extensions.

AppleSeed has automatically collected data from USB drives, keystrokes, and screen images before exfiltration.

NETWIRE can automatically archive collected data.

LoFiSe can collect all the files from the working directory every three hours and place them into a password-protected archive for further exfiltration.

InvisiMole can sort and collect specific documents as well as generate a list of all files on a newly inserted drive and store them in an encrypted file.

VERMIN saves each collected file with the automatically generated format {0:dd-MM-yyyy}.txt .

PACEMAKER can enter a loop to read `/proc/` entries every 2 seconds in order to read a target application's memory.

Lumma Stealer has automated collection of various information including cryptocurrency wallet details.

Rover automatically collects files from the local system and removable drives based on a predefined list of file extensions on a regular timeframe.

LightNeuron can be configured to automatically collect files under a specified directory.

DarkGate searches for stored credentials associated with cryptocurrency wallets and notifies the command and control server when identified.

Metamorfo has automatically collected mouse clicks, continuous screenshots on the machine, and set timers to collect the contents of the clipboard and website browsing.

T9000 searches removable storage devices for files with a pre-defined list of file extensions (e.g. * .doc, *.ppt, *.xls, *.docx, *.pptx, *.xlsx). Any matching files are encrypted and written to a local user directory.

Micropsia executes an RAR tool to recursively archive files based on a predefined list of file extensions (*.xls, *.xlsx, *.csv, *.odt, *.doc, *.docx, *.ppt, *.pptx, *.pdf, *.mdb, *.accdb, *.accde, *.txt).

Attor has automatically collected data about the compromised system.

Crutch can automatically monitor removable drives in a loop and copy interesting files.

RTM monitors browsing activity and automatically captures screenshots if a victim browses to a URL matching one of a list of strings.

StrelaStealer attempts to identify and collect mail login data from Thunderbird and Outlook following execution.

MESSAGETAP checks two files, keyword_parm.txt and parm.txt, for instructions on how to target and save data parsed and extracted from SMS message data from the network traffic. If an SMS message contained either a phone number, IMSI number, or keyword that matched the predefined list, it is saved to a CSV file for later theft by the threat actor.

ccf32 can be used to automatically collect files from a compromised host.

Zebrocy scans the system and automatically collects files with the following extensions: .doc, .docx, ,.xls, .xlsx, .pdf, .pptx, .rar, .zip, .jpg, .jpeg, .bmp, .tiff, .kum, .tlg, .sbx, .cr, .hse, .hsf, and .lhz.

Valak can download a module to search for and build a report of harvested credential data.

For all non-removable drives on a victim, USBStealer executes automated collection of certain files for later exfiltration.

TajMahal has the ability to index and compress files into a send queue for exfiltration.

Raccoon Stealer collects files and directories from victim systems based on configuration data downloaded from command and control servers.

GoldFinder logged and stored information related to the route or hops a packet took from a compromised machine to a hardcoded C2 server, including the target C2 URL, HTTP response/status code, HTTP response headers and values, and data received from the C2 node.

Ramsay can conduct an initial scan for Microsoft Word documents on the local system, removable media, and connected network drives, before tagging and collecting them. It can continue tagging documents to collect with follow up scans.

FunnyDream can monitor files for changes and automatically collect them.

OutSteel can automatically scan for and collect files with specific extensions.

LAMEHUG can recursively copy files from targeted directories on victim hosts.

PoetRAT used file system monitoring to track modification and enable automatic exfiltration.

Shai-Hulud has the ability to automatically collect host data, secrets, system information, and endpoints.

BADNEWS monitors USB devices and copies files with certain extensions to a predefined directory.

A Helminth VBScript receives a batch script to execute a set of commands in a command prompt.

Comnie executes a batch script to store discovery information in %TEMP%\info.dat and then uploads the temporarily file to the remote C2 server.

NPPSPY collection is automatically recorded to a specified file on the victim machine.

ShimRatReporter gathered information automatically, without instruction from a C2, related to the user and host machine that is compiled into a report and sent to the operators.

Pacu can automatically collect data, such as CloudFormation templates, EC2 user data, AWS Inspector reports, and IAM credential reports.

Empire can automatically gather the username, domain name, machine name, and other information from a compromised system.

PoshC2 contains a module for recursively parsing through files and directories to gather valid credit card numbers.

ROADTools automatically gathers data from Azure AD environments using the Azure Graph API.

Mythic supports scripting of file downloads from agents.

TeamPCP Cloud Stealer can identify and collect credentials across over 50 file paths in Cloud, CI/CD, developer tooling, and container enviornments.

Mini Shai-Hulud has the ability to automatically compile gathered credentials from configuration files and password vaults within an archive and exfiltrate stolen data leveraging both a primary and fallback C2.