Data Staged: Local Data Staging

ADVSTORESHELL stores output from command execution in a .dat file in the %TEMP% directory.^[2]

AppleSeed can stage files in a central location prior to exfiltration.^[3]

APT28 has stored captured credential information in a file named pi.log.^[4]

APT3 has been known to stage files for exfiltration in a single location.^[5]

APT39 has utilized tools to aggregate data prior to exfiltration.^[6]

Astaroth collects data in a plaintext file named r1.log before exfiltration. ^[7]

Attor has staged collected data in a central upload directory prior to exfiltration.^[8]

BackdoorDiplomacy has copied files of interest to the main drive's recycle bin.^[9]

BADNEWS copies documents under 15MB found on the victim system to is the user's %temp%\SMB\ folder. It also copies files from USB devices to a predefined directory.^[10][11]

BadPatch stores collected data in log files before exfiltration.^[12]

BoxCaon has created a working folder for collected files that it sends to the C2 server.^[13]

Calisto uses a hidden directory named .calisto to store data from the victim’s machine before exfiltration.^[14][15]

Carbon creates a base directory that contains the files and folders that are collected.^[16]

Catchamas stores the gathered data from the machine in .db files and .bmp files under four separate locations.^[17]

Chimera has staged stolen data locally on compromised hosts.^[18]

Crutch has staged stolen files in the C:\AMD\Temp directory.^[19]

DarkWatchman can stage local data in the Windows Registry.^[1]

Dragonfly has created a directory named "out" in the user's %AppData% folder and copied files to it.^[20]

Dtrack can save collected data to disk, different file formats, and network shares.^[21][22]

Modules can be pushed to and executed by Duqu that copy data to a staging area, compress it, and XOR encrypt it.^[23]

DustySky created folders in temp directories to host collected files before exfiltration.^[24]

Dyre has the ability to create files in a TEMP folder to act as a database to store information.^[25]

ECCENTRICBANDWAGON has stored keystrokes and screenshots within the %temp%\GoogleChrome, %temp%\Downloads, and %temp%\TrendMicroUpdate directories.^[26]

Elise creates a file in AppData\Local\Microsoft\Windows\Explorer and stores all harvested data in that file.^[27]

Exaramel for Windows specifies a path to store files scheduled for exfiltration.^[28]

FIN5 scripts save memory dump data into a specific directory on hosts in the victim environment.^[29]

FLASHFLOOD stages data it copies from the local system or removable drives in the "%WINDIR%\$NtUninstallKB885884$\" directory.^[30]

FrameworkPOS can identifiy payment card track data on the victim and copy it to a local file in a subdirectory of C:\Windows.^[31]

GALLIUM compressed and staged files in multi-part archives in the Recycle Bin prior to exfiltration.^[32]

Gold Dragon stores information gathered from the endpoint in a file named 1.hwp.^[33]

Helminth creates folders to store output from batch scripts prior to sending the information to its C2 server.^[34]

Honeybee adds collected files to a temp.zip file saved in the %temp% folder, then base64 encodes it and uploads it to control server.^[35]

Indrik Spider has stored collected date in a .tmp file.^[36]

InvisiMole determines a working directory where it stores all the gathered data about the compromised machine.^[37][38]

Kazuar stages command output and collected data in files before exfiltration.^[39]

KGH_SPY can save collected system information to a file named "info" before exfiltration.^[40]

Kimsuky has staged collected data files under C:\Program Files\Common Files\System\Ole DB\.^[41][42]

Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is saved in the %TEMP% directory, then compressed, encrypted, and uploaded to a C2 server.^[43][44]

Leviathan has used C:\Windows\Debug and C:\Perflogs as staging directories.^[45][46]

LightNeuron can store email data in files and directories specified in its configuration, such as C:\Windows\ServiceProfiles\NetworkService\appdata\Local\Temp\.^[47]

Machete stores files and logs in a folder on the local drive.^[48][49]

MarkiRAT can store collected data locally in a created .nfo file.^[50]

menuPass stages data prior to exfiltration in multi-part archives, often saved in the Recycle Bin.^[51]

MESSAGETAP stored targeted SMS messages that matched its target list in CSV files on the compromised system.^[52]

MoonWind saves information from its keylogging routine as a .zip file in the present working directory.^[53]

Mustang Panda has stored collected credential files in c:\windows\temp prior to exfiltration. Mustang Panda has also stored documents for exfiltration in a hidden folder on USB drives.^[54][55]

NavRAT writes multiple outputs to a TMP file using the >> method.^[56]

NETWIRE has the ability to write collected data to a file created in the ./LOGS directory.^[57]

NOKKI can collect data from the victim and stage it in LOCALAPPDATA%\MicroSoft Updatea\uplog.tmp.^[58]

ObliqueRAT can copy specific files, webcam captures, and screenshots to local directories.^[59]

Octopus has stored collected information in the Application Data directory on a compromised host.^[60][61]

OopsIE stages the output from command execution and collected files in specific folders before exfiltration.^[62]

Operation Wocao has staged archived files in a temporary directory prior to exfiltration.^[63]

Patchwork copied all targeted files to a directory called index that was eventually uploaded to the C&C server.^[11]

PoisonIvy stages collected data in a text file.^[64]

Prikormka creates a directory, %USERPROFILE%\AppData\Local\SKC\, which is used to store collected log files.^[65]

Pteranodon creates various subdirectories under %Temp%\reports\% and copies files to those subdirectories. It also creates a folder at C:\Users\\AppData\Roaming\Microsoft\store to store screenshot JPEG files.^[66]

PUNCHBUGGY has saved information to a random temp file before exfil.^[67]

PUNCHTRACK aggregates collected data in a tmp file.^[68]

QakBot has stored stolen emails and other data into new folders prior to exfiltration.^[69]

RainyDay can use a file exfiltration tool to copy files to C:\ProgramData\Adobe\temp prior to exfiltration.^[70]

Ramsay can stage data prior to exfiltration in %APPDATA%\Microsoft\UserSetting and %APPDATA%\Microsoft\UserSetting\MediaCache.^[71][72]

Data captured by RawPOS is placed in a temporary file under a directory named "memdump".^[73]

Rover copies files from removable drives to C:\system.^[74]

Sidewinder has collected stolen files in a temporary folder in preparation for exfiltration.^[75]

SombRAT can store harvested data in a custom database under the %TEMP% directory.^[76]

SPACESHIP identifies files with certain extensions and copies them to a directory in the user's profile.^[30]

TEMP.Veles has created staging folders in directories that were infrequently used by legitimate users or processes.^[77]

Threat Group-3390 has locally staged encrypted archives for later exfiltration efforts.^[78]

Trojan.Karagany can create directories to store plugin output and stage data for exfiltration.^[79][80]

Turian can store copied files in a specific directory prior to exfiltration.^[9]

Ursnif has used tmp files to stage gathered information.^[81]

USBStealer collects files matching certain criteria from the victim and stores them in a local directory for later exfiltration.^[82][83]

Zebrocy stores all collected information in a single file before exfiltration.^[84]