Procedure examples

Bumblebee can compress data stolen from the Registry and volume shadow copies prior to exfiltration.

Exaramel for Windows automatically encrypts files before sending them to the C2 server.

JumbledPath can compress and encrypt exfiltrated packet captures from targeted devices.

Backdoor.Oldrea writes collected data to a temporary file in an encrypted form before exfiltration to a C2 server.

Lurid can compress data before sending it.

AppleSeed has compressed collected data before exfiltration.

NETWIRE has the ability to compress archived screenshots.

Aria-body has used ZIP to compress data gathered on a compromised host.

Machete stores zipped files with profile data from installed web browsers.

PowerLess can encrypt browser database files prior to exfiltration.

After collecting documents from removable media, Prikormka compresses the collected files, and encrypts it with Blowfish.

LoFiSe can collect files into password-protected ZIP-archives for exfiltration.

VERMIN encrypts the collected files using 3-DES.

Chrommme can encrypt and store on disk collected data before exfiltration.

RunningRAT contains code to compress files.

Epic encrypts collected data using a public key framework before sending it over the C2 channel. Some variants encrypt the collected data with AES and encode it with base64 before transmitting it to the C2 server.

LightNeuron contains a function to encrypt and store emails that it collects.

MuddyViper has archived collected web browser data into a file named CacheDump.zip.

TAINTEDSCRIBE has used FileReadZipSend to compress a file and send to C2.

LP-Notes has encrypted collected credentials using AES-CBC from the CNG API and the key ED15C8344B45DAED1E0578F8BC1A32411812C61F4CB45D89B107287DE0E09FFC
and the initialization vector 91A4E6F6D51DAEE773A8F00279792578.

Spica can archive collected documents for exfiltration.

KONNI has encrypted data and files prior to exfiltration.

BLUELIGHT can zip files before exfiltration.

WellMail can archive files on the compromised host.

Zebrocy has used a method similar to RC4 as well as AES for encryption and hexadecimal for encoding data before exfiltration.

Cadelspy has the ability to compress stolen data into a .cab file.

Raccoon Stealer archives collected system information in a text f ile, `System info.txt`, prior to exfiltration.

Daserf hides collected data in password-protected .rar archives.

Gold Dragon encrypts data using Base64 before being sent to the command and control server.

Pillowmint has encrypted stolen credit card information with AES and further encoded it with Base64.

Proton zips up files before exfiltrating them.

Kessel can RC4-encrypt credentials before sending to the C2.

FELIXROOT encrypts collected data with AES and Base64 and then sends it to the C2 server.

Troll Stealer compresses stolen data prior to exfiltration.

XCSSET will compress entire ~/Desktop folders excluding all .git folders, but only if the total data size is under 200MB.

Agent Tesla can encrypt data with 3DES before sending it over to a C2 server.

Remexi encrypts and adds all gathered browser data into files for upload to C2.

Lizar has encrypted data before sending it to the server.

Dtrack packs collected data into a password protected archive.

ADVSTORESHELL encrypts with the 3DES algorithm and a hardcoded key prior to exfiltration.

BloodHound can compress data collected by its SharpHound ingestor into a ZIP file to be written to disk.

ShimRatReporter used LZ compression to compress initial reconnaissance reports before sending to the C2.

Empire can ZIP directories on the target system.

Mini Shai-Hulud has compressed collected credentials to reduce transmission size and to make string content harder to detect in memory forensics captures.