Technique:  Archive Collected Data:Archive via Utility
AppleSeed can zip and encrypt data collected on a target system.
It has used RAR to compress files before moving them outside of the victim network.
It has used a variety of utilities, including WinRAR, to archive collected data with password protection.
It has used tools to compress data before exfilling it.
It has used WinRAR to compress data prior to exfil.
It has used WinRAR and 7-Zip to compress an archive stolen data.
It created a RAR archive of targeted files for exfiltration.
It has used WinRAR to compress memory dumps prior to exfiltration.
It has compressed data into password-protected RAR archives prior to exfiltration.
During C0026, the threat actors used WinRAR to collect documents on targeted systems. The threat actors appeared to only exfiltrate files created after January 1, 2021.
Calisto uses the zip -r command to compress the data collected on the local system.
ccf32 has used xcopy \\<target_host>\c$\users\public\path.7z c:\users\public\bin\<target_host>.7z /H /Y to archive collected files.
certutil may be used to Base64 encode collected data.
It has used gzip for Linux OS and a modified RAR software to archive data on Windows hosts.
It uses ZPP, a .NET console program, to compress files with ZIP.
CORALDECK has created password-protected RAR, WinImage, and zip archives to be exfiltrated.
Crutch has used the WinRAR utility to compress and encrypt stolen files.
Daserf hides collected data in password-protected .rar archives.
DustySky can compress files via RAR while staging data to be exfiltrated.
It has used WinRAR to compress stolen files into an archive prior to exfiltration.
It has compressed the dump output of compromised credentials with a 7zip binary.
It has used RAR to compress collected data before exfiltration.
It has used 7-Zip to archive data.
During FunnyDream, the threat actors used 7zr.exe to add collected files to an archive.
It used WinRAR to compress and encrypt stolen data prior to exfiltration.
It has used WinZip, likely to archive data prior to exfiltration.
It has used 7-Zip and WinRAR to compress stolen files for exfiltration.
IceApple can encrypt and compress files using Gzip prior to exfiltration.
iKitten will zip up the /Library/Keychains directory before exfiltrating it.
InvisiMole uses WinRAR to compress data that is intended to be exfiltrated.
It is known to use 7Zip and RAR with passwords to encrypt data prior to exfiltration.
It has used QuickZip to archive stolen files before exfiltration.
It has used gzip to archive dumped LSASS process memory and RAR to stage and compress local folders.
It has compressed files before exfiltration using TAR and RAR.
Micropsia creates a RAR archive based on collected files on the victim's machine.
It has used the native Windows cabinet creation tool, makecab.exe, likely to compress stolen data to be uploaded.
It has used RAR to create password-protected archives of collected documents prior to exfiltration.
Octopus has compressed data before exfiltrating it using a tool called Abbrevia.
Okrum was seen using a RAR archiver tool to compress/decompress data.
OopsIE compresses collected files with GZipStream before sending them to its C2 server.
During Operation CuckooBees, the threat actors used the Makecab utility to compress and a version of WinRAR to create password-protected archives of stolen data prior to exfiltration.
During Operation Dream Job, It archived victim's data into a RAR file.
During Operation Honeybee, the threat actors uses zip to pack collected files before exfiltration.
During Operation Wocao, threat actors archived collected files with WinRAR, prior to exfiltration.
PoetRAT has the ability to compress files with zip.
PoshC2 contains a module for compressing data using ZIP.
PowerShower has used 7Zip to compress .txt, .pdf, .xls or .doc files prior to exfiltration.
PUNCHBUGGY has Gzipped information and saved it to a random temp file before exfil.
Pupy can compress data with Zip before sending it over C2.
Ramsay can compress and archive collected files using WinRAR.
Rclone can compress files using gzip prior to exfiltration.
During the SolarWinds Compromise, It used 7-Zip to compress stolen emails into password-protected archives prior to exfltration; It also compressed text files into zipped archives.
It extracted documents and bundled them into a RAR archive.
Turian can use WinRAR to create a password-protected archive for files of interest.
It has encrypted files stolen from connected USB drives into a RAR file before exfiltration.
It has archived the ntds.dit database as a multi-volume password-protected archive with 7-Zip.
WindTail has the ability to use the macOS built-in zip utility to archive files.
It has archived data into ZIP files on compromised machines.