Procedure examples

WindTail has the ability to use the macOS built-in zip utility to archive files.

InvisibleFerret has used 7zip, RAR and zip files to archive collected data for exfiltration.

TONESHELL used WinRAR rar.exe to archive files for exfiltration. TONESHELL has also utilized a unique 13-character password consisting of upper lower case and digits to protect RAR archives.

AppleSeed can zip and encrypt data collected on a target system.

iKitten will zip up the /Library/Keychains directory before exfiltrating it.

Turian can use WinRAR to create a password-protected archive for files of interest.

PUBLOAD has used utilities such as `WinRAR` to archive data prior to exfiltration.

InvisiMole uses WinRAR to compress data that is intended to be exfiltrated.

Okrum was seen using a RAR archiver tool to compress/decompress data.

PowerShower has used 7Zip to compress .txt, .pdf, .xls or .doc files prior to exfiltration.

PUNCHBUGGY has Gzipped information and saved it to a random temp file before exfil.

BeaverTail has collected and archived sensitive data in a zip file.

DustySky can compress files via RAR while staging data to be exfiltrated.

Sagerunex has archived collected materials in RAR format.

GlassWorm has archived collected files within a zip file prior to exfiltration to include `/tmp/out.zip`.

CORALDECK has created password-protected RAR, WinImage, and zip archives to be exfiltrated.

Micropsia creates a RAR archive based on collected files on the victim's machine.

OopsIE compresses collected files with GZipStream before sending them to its C2 server.

Crutch has used the WinRAR utility to compress and encrypt stolen files.

ccf32 has used `xcopy \\<target_host>\c$\users\public\path.7z c:\users\public\bin\<target_host>.7z /H /Y` to archive collected files.

SampleCheck5000 can gzip compress files uploaded to a shared mailbox used for C2 and exfiltration.

Daserf hides collected data in password-protected .rar archives.

Calisto uses the zip -r command to compress the data collected on the local system.

Ramsay can compress and archive collected files using WinRAR.

LAMEHUG can xcopy for file collection on targeted systems.

PoetRAT has the ability to compress files with zip.

IceApple can encrypt and compress files using Gzip prior to exfiltration.

LunarWeb can create a ZIP archive with specified files and directories.

Octopus has compressed data before exfiltrating it using a tool called Abbrevia.

certutil may be used to Base64 encode collected data.

PoshC2 contains a module for compressing data using ZIP.

Rclone can compress files using `gzip` prior to exfiltration.

Remcos can zip files and folders for upload.

Pupy can compress data with Zip before sending it over C2.

TeamPCP Cloud Stealer has bundled collected data into a file named tpcp.tar.gz for exfiltration.

Mini Shai-Hulud has compressed collected credentials and data within tar archive files prior to exfiltration.