Procedure examples

Spica can archive collected documents for exfiltration.

KONNI has encrypted data and files prior to exfiltration.

BLUELIGHT can zip files before exfiltration.

WellMail can archive files on the compromised host.

Zebrocy has used a method similar to RC4 as well as AES for encryption and hexadecimal for encoding data before exfiltration.

Cadelspy has the ability to compress stolen data into a .cab file.

Raccoon Stealer archives collected system information in a text f ile, `System info.txt`, prior to exfiltration.

Daserf hides collected data in password-protected .rar archives.

Gold Dragon encrypts data using Base64 before being sent to the command and control server.

Pillowmint has encrypted stolen credit card information with AES and further encoded it with Base64.

Proton zips up files before exfiltrating them.

Kessel can RC4-encrypt credentials before sending to the C2.

FELIXROOT encrypts collected data with AES and Base64 and then sends it to the C2 server.

Troll Stealer compresses stolen data prior to exfiltration.

XCSSET will compress entire ~/Desktop folders excluding all .git folders, but only if the total data size is under 200MB.

Agent Tesla can encrypt data with 3DES before sending it over to a C2 server.

Remexi encrypts and adds all gathered browser data into files for upload to C2.

Lizar has encrypted data before sending it to the server.

Dtrack packs collected data into a password protected archive.

ADVSTORESHELL encrypts with the 3DES algorithm and a hardcoded key prior to exfiltration.

BloodHound can compress data collected by its SharpHound ingestor into a ZIP file to be written to disk.

ShimRatReporter used LZ compression to compress initial reconnaissance reports before sending to the C2.

Empire can ZIP directories on the target system.

Mini Shai-Hulud has compressed collected credentials to reduce transmission size and to make string content harder to detect in memory forensics captures.

WindTail has the ability to use the macOS built-in zip utility to archive files.

InvisibleFerret has used 7zip, RAR and zip files to archive collected data for exfiltration.

TONESHELL used WinRAR rar.exe to archive files for exfiltration. TONESHELL has also utilized a unique 13-character password consisting of upper lower case and digits to protect RAR archives.

AppleSeed can zip and encrypt data collected on a target system.

iKitten will zip up the /Library/Keychains directory before exfiltrating it.

Turian can use WinRAR to create a password-protected archive for files of interest.

PUBLOAD has used utilities such as `WinRAR` to archive data prior to exfiltration.

InvisiMole uses WinRAR to compress data that is intended to be exfiltrated.

Okrum was seen using a RAR archiver tool to compress/decompress data.

PowerShower has used 7Zip to compress .txt, .pdf, .xls or .doc files prior to exfiltration.

PUNCHBUGGY has Gzipped information and saved it to a random temp file before exfil.

BeaverTail has collected and archived sensitive data in a zip file.

DustySky can compress files via RAR while staging data to be exfiltrated.

Sagerunex has archived collected materials in RAR format.

GlassWorm has archived collected files within a zip file prior to exfiltration to include `/tmp/out.zip`.

CORALDECK has created password-protected RAR, WinImage, and zip archives to be exfiltrated.

Micropsia creates a RAR archive based on collected files on the victim's machine.

OopsIE compresses collected files with GZipStream before sending them to its C2 server.

Crutch has used the WinRAR utility to compress and encrypt stolen files.

ccf32 has used `xcopy \\<target_host>\c$\users\public\path.7z c:\users\public\bin\<target_host>.7z /H /Y` to archive collected files.

SampleCheck5000 can gzip compress files uploaded to a shared mailbox used for C2 and exfiltration.

Daserf hides collected data in password-protected .rar archives.

Calisto uses the zip -r command to compress the data collected on the local system.

Ramsay can compress and archive collected files using WinRAR.

LAMEHUG can xcopy for file collection on targeted systems.

PoetRAT has the ability to compress files with zip.