Data Staged: Local Data Staging

ADVSTORESHELL stores output from command execution in a .dat file in the %TEMP% directory.^[1]

AppleSeed can stage files in a central location prior to exfiltration.^[2]

APT28 has stored captured credential information in a file named pi.log.^[3]

APT3 has been known to stage files for exfiltration in a single location.^[4]

APT39 has utilized tools to aggregate data prior to exfiltration.^[5]

Astaroth collects data in a plaintext file named r1.log before exfiltration. ^[6]

Attor has staged collected data in a central upload directory prior to exfiltration.^[7]

BackdoorDiplomacy has copied files of interest to the main drive's recycle bin.^[8]

BADNEWS copies documents under 15MB found on the victim system to is the user's %temp%\SMB\ folder. It also copies files from USB devices to a predefined directory.^[9][10]

BadPatch stores collected data in log files before exfiltration.^[11]

BoxCaon has created a working folder for collected files that it sends to the C2 server.^[12]

Calisto uses a hidden directory named .calisto to store data from the victim’s machine before exfiltration.^[13][14]

Carbon creates a base directory that contains the files and folders that are collected.^[15]

Catchamas stores the gathered data from the machine in .db files and .bmp files under four separate locations.^[16]

Chimera has staged stolen data locally on compromised hosts.^[17]

Crutch has staged stolen files in the C:\AMD\Temp directory.^[18]

Dragonfly 2.0 created a directory named "out" in the user's %AppData% folder and copied files to it.^[19]

Dtrack can save collected data to disk, different file formats, and network shares.^[20][21]

Modules can be pushed to and executed by Duqu that copy data to a staging area, compress it, and XOR encrypt it.^[22]

DustySky created folders in temp directories to host collected files before exfiltration.^[23]

Dyre has the ability to create files in a TEMP folder to act as a database to store information.^[24]

ECCENTRICBANDWAGON has stored keystrokes and screenshots within the %temp%\GoogleChrome, %temp%\Downloads, and %temp%\TrendMicroUpdate directories.^[25]

Elise creates a file in AppData\Local\Microsoft\Windows\Explorer and stores all harvested data in that file.^[26]

Exaramel for Windows specifies a path to store files scheduled for exfiltration.^[27]

FIN5 scripts save memory dump data into a specific directory on hosts in the victim environment.^[28]

FLASHFLOOD stages data it copies from the local system or removable drives in the "%WINDIR%\$NtUninstallKB885884$\" directory.^[29]

FrameworkPOS can identifiy payment card track data on the victim and copy it to a local file in a subdirectory of C:\Windows.^[30]

GALLIUM compressed and staged files in multi-part archives in the Recycle Bin prior to exfiltration.^[31]

Gold Dragon stores information gathered from the endpoint in a file named 1.hwp.^[32]

Helminth creates folders to store output from batch scripts prior to sending the information to its C2 server.^[33]

Honeybee adds collected files to a temp.zip file saved in the %temp% folder, then base64 encodes it and uploads it to control server.^[34]

Indrik Spider has stored collected date in a .tmp file.^[35]

InvisiMole determines a working directory where it stores all the gathered data about the compromised machine.^[36][37]

Kazuar stages command output and collected data in files before exfiltration.^[38]

KGH_SPY can save collected system information to a file named "info" before exfiltration.^[39]

Kimsuky has staged collected data files under C:\Program Files\Common Files\System\Ole DB\.^[40]

Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is saved in the %TEMP% directory, then compressed, encrypted, and uploaded to a C2 server.^[41][42]

Leviathan has used C:\Windows\Debug and C:\Perflogs as staging directories.^[43][44]

LightNeuron can store email data in files and directories specified in its configuration, such as C:\Windows\ServiceProfiles\NetworkService\appdata\Local\Temp\.^[45]

Machete stores files and logs in a folder on the local drive.^[46][47]

MarkiRAT can store collected data locally in a created .nfo file.^[48]

menuPass stages data prior to exfiltration in multi-part archives, often saved in the Recycle Bin.^[49]

MESSAGETAP stored targeted SMS messages that matched its target list in CSV files on the compromised system.^[50]

MoonWind saves information from its keylogging routine as a .zip file in the present working directory.^[51]

Mustang Panda has stored collected credential files in c:\windows\temp prior to exfiltration. Mustang Panda has also stored documents for exfiltration in a hidden folder on USB drives.^[52][53]

NavRAT writes multiple outputs to a TMP file using the >> method.^[54]

NETWIRE has the ability to write collected data to a file created in the ./LOGS directory.^[55]

NOKKI can collect data from the victim and stage it in LOCALAPPDATA%\MicroSoft Updatea\uplog.tmp.^[56]

ObliqueRAT can copy specific files, webcam captures, and screenshots to local directories.^[57]

Octopus has stored collected information in the Application Data directory on a compromised host.^[58][59]

OopsIE stages the output from command execution and collected files in specific folders before exfiltration.^[60]

Operation Wocao has staged archived files in a temporary directory prior to exfiltration.^[61]

Patchwork copied all targeted files to a directory called index that was eventually uploaded to the C&C server.^[10]

PoisonIvy stages collected data in a text file.^[62]

Prikormka creates a directory, %USERPROFILE%\AppData\Local\SKC\, which is used to store collected log files.^[63]

Pteranodon creates various subdirectories under %Temp%\reports\% and copies files to those subdirectories. It also creates a folder at C:\Users\\AppData\Roaming\Microsoft\store to store screenshot JPEG files.^[64]

PUNCHBUGGY has saved information to a random temp file before exfil.^[65]

PUNCHTRACK aggregates collected data in a tmp file.^[66]

QakBot has stored stolen emails and other data into new folders prior to exfiltration.^[67]

RainyDay can use a file exfiltration tool to copy files to C:\ProgramData\Adobe\temp prior to exfiltration.^[68]

Ramsay can stage data prior to exfiltration in %APPDATA%\Microsoft\UserSetting and %APPDATA%\Microsoft\UserSetting\MediaCache.^[69][70]

Data captured by RawPOS is placed in a temporary file under a directory named "memdump".^[71]

Rover copies files from removable drives to C:\system.^[72]

Sidewinder has collected stolen files in a temporary folder in preparation for exfiltration.^[73]

SombRAT can store harvested data in a custom database under the %TEMP% directory.^[74]

SPACESHIP identifies files with certain extensions and copies them to a directory in the user's profile.^[29]

TEMP.Veles has created staging folders in directories that were infrequently used by legitimate users or processes.^[75]

Threat Group-3390 has locally staged encrypted archives for later exfiltration efforts.^[76]

Trojan.Karagany can create directories to store plugin output and stage data for exfiltration.^[77][78]

Turian can store copied files in a specific directory prior to exfiltration.^[8]

Ursnif has used tmp files to stage gathered information.^[79]

USBStealer collects files matching certain criteria from the victim and stores them in a local directory for later exfiltration.^[80][81]

Zebrocy stores all collected information in a single file before exfiltration.^[82]