Data Staged: Local Data Staging

ADVSTORESHELL stores output from command execution in a .dat file in the %TEMP% directory.^[2]

Agrius has used the folder, C:\windows\temp\s\, to stage data for exfiltration.^[3]

AppleSeed can stage files in a central location prior to exfiltration.^[4]

APT28 has stored captured credential information in a file named pi.log.^[5]

APT3 has been known to stage files for exfiltration in a single location.^[6]

APT39 has utilized tools to aggregate data prior to exfiltration.^[7]

APT41 DUST involved exporting data from Oracle databases to local CSV files prior to exfiltration.^[8]

APT5 has staged data on compromised systems prior to exfiltration often in C:\Users\Public.^[9]

Astaroth collects data in a plaintext file named r1.log before exfiltration. ^[10]

Attor has staged collected data in a central upload directory prior to exfiltration.^[11]

AuTo Stealer can store collected data from an infected host to a file named Hostname_UserName.txt prior to exfiltration.^[12]

BackdoorDiplomacy has copied files of interest to the main drive's recycle bin.^[13]

BADNEWS copies documents under 15MB found on the victim system to is the user's %temp%\SMB\ folder. It also copies files from USB devices to a predefined directory.^[14][15]

BadPatch stores collected data in log files before exfiltration.^[16]

BoxCaon has created a working folder for collected files that it sends to the C2 server.^[17]

During C0015, PowerView's file share enumeration results were stored in the file c:\ProgramData\found_shares.txt.^[18]

During C0017, APT41 copied the local SAM and SYSTEM Registry hives to a staging directory.^[19]

During the C0032 campaign, TEMP.Veles used staging folders that are infrequently used by legitimate users or processes to store data for exfiltration and tool deployment.^[20]

Calisto uses a hidden directory named .calisto to store data from the victim’s machine before exfiltration.^[21][22]

Carbon creates a base directory that contains the files and folders that are collected.^[23]

Catchamas stores the gathered data from the machine in .db files and .bmp files under four separate locations.^[24]

ccf32 can temporarily store files in a hidden directory on the local host.^[25]

Chimera has staged stolen data locally on compromised hosts.^[26]

CHIMNEYSWEEP can store captured screenshots to disk including to a covert store named APPX.%x%x%x%x%x.tmp where %x is a random value.^[27]

Chrommme can store captured system information locally prior to exfiltration.^[28]

Crutch has staged stolen files in the C:\AMD\Temp directory.^[29]

Cuckoo Stealer has staged collected application data from Safari, Notes, and Keychain to /var/folder.^[30]

DarkWatchman can stage local data in the Windows Registry.^[1]

Dragonfly has created a directory named "out" in the user's %AppData% folder and copied files to it.^[31]

Dtrack can save collected data to disk, different file formats, and network shares.^[32][33]

Modules can be pushed to and executed by Duqu that copy data to a staging area, compress it, and XOR encrypt it.^[34]

DustySky created folders in temp directories to host collected files before exfiltration.^[35]

Dyre has the ability to create files in a TEMP folder to act as a database to store information.^[36]

ECCENTRICBANDWAGON has stored keystrokes and screenshots within the %temp%\GoogleChrome, %temp%\Downloads, and %temp%\TrendMicroUpdate directories.^[37]

Elise creates a file in AppData\Local\Microsoft\Windows\Explorer and stores all harvested data in that file.^[38]

Exaramel for Windows specifies a path to store files scheduled for exfiltration.^[39]

FIN13 has utilized the following temporary folders on compromised Windows and Linux systems for their operations prior to exfiltration: C:\Windows\Temp and /tmp.^[40][41]

FIN5 scripts save memory dump data into a specific directory on hosts in the victim environment.^[42]

FLASHFLOOD stages data it copies from the local system or removable drives in the "%WINDIR%\$NtUninstallKB885884$\" directory.^[43]

FrameworkPOS can identifiy payment card track data on the victim and copy it to a local file in a subdirectory of C:\Windows.^[44]

FunnyDream can stage collected information including screen captures and logged keystrokes locally.^[25]

GALLIUM compressed and staged files in multi-part archives in the Recycle Bin prior to exfiltration.^[45]

Gold Dragon stores information gathered from the endpoint in a file named 1.hwp.^[46]

Helminth creates folders to store output from batch scripts prior to sending the information to its C2 server.^[47]

Indrik Spider has stored collected data in a .tmp file.^[48]

InvisiMole determines a working directory where it stores all the gathered data about the compromised machine.^[49][50]

Kazuar stages command output and collected data in files before exfiltration.^[51]

KGH_SPY can save collected system information to a file named "info" before exfiltration.^[52]

Kimsuky has staged collected data files under C:\Program Files\Common Files\System\Ole DB\.^[53][54]

KOPILUWAK has piped the results from executed C2 commands to %TEMP%\result2.dat on the local machine.^[55]

Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is saved in the %TEMP% directory, then compressed, encrypted, and uploaded to a C2 server.^[56][57]

Leviathan has used C:\Windows\Debug and C:\Perflogs as staging directories.^[58][59]

LightNeuron can store email data in files and directories specified in its configuration, such as C:\Windows\ServiceProfiles\NetworkService\appdata\Local\Temp\.^[60]

LoFiSe can save files to be evaluated for further exfiltration in the C:\Programdata\Microsoft\ and C:\windows\temp\ folders. ^[61]

LunarMail can create a directory in %TEMP%\ to stage data prior to exfilration.^[62]

Machete stores files and logs in a folder on the local drive.^[63][64]

MacMa has stored collected files locally before exfiltration.^[65]

Mafalda can place retrieved files into a destination directory.^[66]

MarkiRAT can store collected data locally in a created .nfo file.^[67]

menuPass stages data prior to exfiltration in multi-part archives, often saved in the Recycle Bin.^[68]

MESSAGETAP stored targeted SMS messages that matched its target list in CSV files on the compromised system.^[69]

metaMain has stored the collected system files in a working directory.^[66][70]

Milan has saved files prior to upload from a compromised host to folders beginning with the characters a9850d2f.^[71]

Mis-Type has temporarily stored collected information to the files "%AppData%\{Unique Identifier}\HOSTRURKLSR" and "%AppData%\{Unique Identifier}\NEWERSSEMP".^[72]

MoonWind saves information from its keylogging routine as a .zip file in the present working directory.^[73]

MuddyWater has stored a decoy PDF file within a victim's %temp% folder.^[74]

Mustang Panda has stored collected credential files in c:\windows\temp prior to exfiltration. Mustang Panda has also stored documents for exfiltration in a hidden folder on USB drives.^[75][76]

NavRAT writes multiple outputs to a TMP file using the >> method.^[77]

NETWIRE has the ability to write collected data to a file created in the ./LOGS directory.^[78]

NightClub has copied captured files and keystrokes to the %TEMP% directory of compromised hosts.^[79]

NOKKI can collect data from the victim and stage it in LOCALAPPDATA%\MicroSoft Updatea\uplog.tmp.^[80]

ObliqueRAT can copy specific files, webcam captures, and screenshots to local directories.^[81]

Octopus has stored collected information in the Application Data directory on a compromised host.^[82][83]

OopsIE stages the output from command execution and collected files in specific folders before exfiltration.^[84]

During Operation Honeybee, stolen data was copied into a text file using the format From <COMPUTER-NAME> (<Month>-<Day> <Hour>-<Minute>-<Second>).txt prior to compression, encoding, and exfiltration.^[85]

During Operation Wocao, threat actors staged archived files in a temporary directory prior to exfiltration.^[86]

PACEMAKER has written extracted data to tmp/dsserver-check.statementcounters.^[87]

Patchwork copied all targeted files to a directory called index that was eventually uploaded to the C&C server.^[15]

PoisonIvy stages collected data in a text file.^[88]

PowerLess can stage stolen browser data in C:\\Windows\\Temp\\cup.tmp and keylogger data in C:\\Windows\\Temp\\Report.06E17A5A-7325-4325-8E5D-E172EBA7FC5BK.^[89]

Prikormka creates a directory, %USERPROFILE%\AppData\Local\SKC\, which is used to store collected log files.^[90]

Pteranodon creates various subdirectories under %Temp%\reports\% and copies files to those subdirectories. It also creates a folder at C:\Users\\AppData\Roaming\Microsoft\store to store screenshot JPEG files.^[91]

PUNCHBUGGY has saved information to a random temp file before exfil.^[92]

PUNCHTRACK aggregates collected data in a tmp file.^[93]

QakBot has stored stolen emails and other data into new folders prior to exfiltration.^[94]

RainyDay can use a file exfiltration tool to copy files to C:\ProgramData\Adobe\temp prior to exfiltration.^[95]

Ramsay can stage data prior to exfiltration in %APPDATA%\Microsoft\UserSetting and %APPDATA%\Microsoft\UserSetting\MediaCache.^[96][97]

Data captured by RawPOS is placed in a temporary file under a directory named "memdump".^[98]

Rover copies files from removable drives to C:\system.^[99]

Sidewinder has collected stolen files in a temporary folder in preparation for exfiltration.^[100]

SLIGHTPULSE has piped the output from executed commands to /tmp/1.^[87]

SLOWPULSE can write logged ACE credentials to /home/perl/PAUS.pm in append mode, using the format string %s:%s\n.^[87]

SocGholish can send output from whoami to a local temp file using the naming convention rad<5-hex-chars>.tmp.^[101]

SombRAT can store harvested data in a custom database under the %TEMP% directory.^[102]

SPACESHIP identifies files with certain extensions and copies them to a directory in the user's profile.^[43]

STARWHALE has stored collected data in a file called stari.txt.^[103]

SUGARDUMP has stored collected data under %<malware_execution_folder>%\\CrashLog.txt.^[104]

TeamTNT has aggregated collected credentials in text files before exfiltrating.^[105]

Threat Group-3390 has locally staged encrypted archives for later exfiltration efforts.^[106]

Trojan.Karagany can create directories to store plugin output and stage data for exfiltration.^[107][108]

Turian can store copied files in a specific directory prior to exfiltration.^[13]

Ursnif has used tmp files to stage gathered information.^[109]

USBStealer collects files matching certain criteria from the victim and stores them in a local directory for later exfiltration.^[110][111]

VersaMem staged captured credentials locally at /tmp/.temp.data.^[112]

Volt Typhoon has saved stolen files including the ntds.dit database and the SYSTEM and SECURITY Registry hives locally to the C:\Windows\Temp\ directory.^[113][114]

Wizard Spider has staged ZIP files in local directories such as, C:\PerfLogs\1\ and C:\User\1\ prior to exfiltration.^[115]

Zebrocy stores all collected information in a single file before exfiltration.^[116]