value:  BadPatch stores collected data in log files before exfiltration. ;; Calisto uses a hidden directory named .calisto to store data from the victim’s machine before exfiltration. ;; Carbon creates a base directory that contains the files and folders that are collected. ;; Catchamas stores the gathered data from the machine in .db files and .bmp files under four separate locations. ;; Chimera has staged stolen data locally on compromised hosts. ;; Crutch has staged stolen files in the C:\AMD\Temp directory. ;; Dragonfly 2.0 created a directory named out" in the user's %AppData% folder and copied files to it. ;; Dtrack can save collected data to disk different file formats and network shares. ;; Modules can be pushed to and executed by Duqu that copy data to a staging area compress it and XOR encrypt it. ;; DustySky created folders in temp directories to host collected files before exfiltration. ;; Dyre has the ability to create files in a TEMP folder to act as a database to store information. ;; ECCENTRICBANDWAGON has stored keystrokes and screenshots within the %temp%\GoogleChrome %temp%\Downloads and %temp%\TrendMicroUpdate directories. ;; Elise creates a file in AppData\Local\Microsoft\Windows\Explorer and stores all harvested data in that file. ;; Exaramel for Windows specifies a path to store files scheduled for exfiltration. ;; FIN5 scripts save memory dump data into a specific directory on hosts in the victim environment. ;; FLASHFLOOD stages data it copies from the local system or removable drives in the "%WINDIR%\$NtUninstallKB885884$\" directory. ;; FrameworkPOS can identifiy payment card track data on the victim and copy it to a local file in a subdirectory of C:\Windows. ;; GALLIUM compressed and staged files in multi-part archives in the Recycle Bin prior to exfiltration. ;; Gold Dragon stores information gathered from the endpoint in a file named 1.hwp. ;; Helminth creates folders to store output from batch scripts prior to sending the information to its C2 server. ;; Honeybee adds collected files to a temp.zip file saved in the %temp% folder then base64 encodes it and uploads it to control server. ;; InvisiMole determines a working directory where it stores all the gathered data about the compromised machine. ;; Kazuar stages command output and collected data in files before exfiltration. ;; KGH_SPY can save collected system information to a file named "info" before exfiltration. ;; Kimsuky has staged collected data files under C:\Program Files\Common Files\System\Ole DB\. ;; Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is saved in the %TEMP% directory then compressed encrypted and uploaded to a C2 server. ;; Leviathan has used C:\Windows\Debug and C:\Perflogs as staging directories. ;; LightNeuron can store email data in files and directories specified in its configuration such as C:\Windows\ServiceProfiles\NetworkService\appdata\Local\Temp\. ;; Machete stores files and logs in a folder on the local drive. ;; menuPass stages data prior to exfiltration in multi-part archives often saved in the Recycle Bin. ;; MESSAGETAP stored targeted SMS messages that matched its target list in CSV files on the compromised system. ;; MoonWind saves information from its keylogging routine as a .zip file in the present working directory. ;; Mustang Panda has stored collected credential files in c:\windows\temp prior to exfiltration. Mustang Panda has also stored documents for exfiltration in a hidden folder on USB drives. ;; NavRAT writes multiple outputs to a TMP file using the >> method. ;; NETWIRE has the ability to write collected data to a file created in the ./LOGS directory. ;; NOKKI can collect data from the victim and stage it in LOCALAPPDATA%\MicroSoft Updatea\uplog.tmp. ;; OopsIE stages the output from command execution and collected files in specific folders before exfiltration. ;; Operation Wocao has staged archived files in a temporary directory prior to exfiltration. ;; Patchwork copied all targeted files to a directory called index that was eventually uploaded to the C&C server. ;; PoisonIvy stages collected data in a text file. ;; Prikormka creates a directory %USERPROFILE%\AppData\Local\SKC\ which is used to store collected log files. ;; Pteranodon creates various subdirectories under %Temp%\reports\% and copies files to those subdirectories. It also creates a folder at C:\Users\\AppData\Roaming\Microsoft\store to store screenshot JPEG files. ;; PUNCHBUGGY has saved information to a random temp file before exfil. ;; PUNCHTRACK aggregates collected data in a tmp file. ;; Ramsay can stage data prior to exfiltration in %APPDATA%\Microsoft\UserSetting and %APPDATA%\Microsoft\UserSetting\MediaCache. ;; Data captured by RawPOS is placed in a temporary file under a directory named "memdump". ;; Rover copies files from removable drives to C:\system. ;; Sidewinder has collected stolen files in a temporary folder in preparation for exfiltration. ;; SPACESHIP identifies files with certain extensions and copies them to a directory in the user's profile. ;; TEMP.Veles has created staging folders in directories that were infrequently used by legitimate users or processes. ;; Threat Group-3390 has locally staged encrypted archives for later exfiltration efforts. ;; Trojan.Karagany can create directories to store plugin output and stage data for exfiltration. ;; Ursnif has used tmp files to stage gathered information. ;; USBStealer collects files matching certain criteria from the victim and stores them in a local directory for later exfiltration. ;; Zebrocy stores all collected information in a single file before exfiltration."
name: Data Staged: Local Data Staging