value:  Calisto uses the zip -r command to compress the data collected on the local system. ;; Chimera has used gzip for Linux OS and a modified RAR software to archive data on Windows hosts. ;; CopyKittens uses ZPP a .NET console program to compress files with ZIP. ;; CORALDECK has created password-protected RAR WinImage and zip archives to be exfiltrated. ;; Crutch has used the WinRAR utility to compress and encrypt stolen files. ;; Daserf hides collected data in password-protected .rar archives. ;; DustySky can compress files via RAR while staging data to be exfiltrated. ;; FIN8 has used RAR to compress collected data before Exfiltration. ;; Fox Kitten has used 7-Zip to archive data. ;; GALLIUM used WinRAR to compress and encrypt stolen data prior to exfiltration. ;; Gallmaker has used WinZip likely to archive data prior to exfiltration. ;; HAFNIUM has used 7-Zip and WinRAR to compress stolen files for exfiltration. ;; iKitten will zip up the /Library/Keychains directory before exfiltrating it. ;; InvisiMole uses WinRAR to compress data that is intended to be exfiltrated. ;; Ke3chang is known to use RAR with passwords to encrypt data prior to exfiltration. ;; Magic Hound has used RAR to stage and compress local folders. ;; menuPass has compressed files before exfiltration using TAR and RAR. ;; Micropsia creates a RAR archive based on collected files on the victim's machine. ;; MuddyWater has used the native Windows cabinet creation tool makecab.exe likely to compress stolen data to be uploaded. ;; Mustang Panda has used RAR to create password-protected archives of collected documents prior to exfiltration. ;; Okrum was seen using a RAR archiver tool to compress/decompress data. ;; OopsIE compresses collected files with GZipStream before sending them to its C2 server. ;; Operation Wocao has archived collected files with WinRAR prior to exfiltration. ;; PoetRAT has the ability to compress files with zip. ;; PoshC2 contains a module for compressing data using ZIP. ;; PowerShower has used 7Zip to compress .txt .pdf .xls or .doc files prior to exfiltration. ;; PUNCHBUGGY has Gzipped information and saved it to a random temp file before exfil. ;; Pupy can compress data with Zip before sending it over C2. ;; Ramsay can compress and archive collected files using WinRAR. ;; Sowbug extracted documents and bundled them into a RAR archive. ;; Turla has encrypted files stolen from connected USB drives into a RAR file before exfiltration. ;; UNC2452 used 7-Zip to compress stolen emails into password-protected archives prior to exfiltration. ;; WindTail has the ability to use the macOS built-in zip utility to archive files.
name: Archive Collected Data: Archive Via Utility