MalwareUsed by 1 actor

FlashFileGrabber

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Paper Werewolf

The payloads used by PowerModul include the PowerTaskel, FlashFileGrabber, and USB Worm tools.

via securelistsecurelist.com

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.001PowerShellEvidence2

The malicious HTA runs a PowerShell script... The “UserCacheHelper.lnk.js” file launches a PowerShell file named “UserCache.ini”... PowerModul is a PowerShell script capable of receiving and executing additional PowerShell scripts from the C2 server.

Discovery

1 technique

T1083File and Directory DiscoveryEvidence1

FlashFileGrabberOffline searches removable media for files with specific extensions... FolderFileGrabber... can grab files from remote systems via a hardcoded network path using the SMB protocol.

Collection

1 technique

T1025Data from Removable MediaEvidence2

FlashFileGrabber is designed to steal files from removable media, such as flash drives... FlashFileGrabberOffline searches removable media for files with specific extensions, and when found, copies them to the local disk.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

PowerModul ... может получать с командного сервера дополнительные PowerShell-скрипты и выполнять их

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

FlashFileGrabber largely duplicates the functionality of FlashFileGrabberOffline, but with one key difference: it is capable of sending files to the C2 server.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app1 year ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

securelist ruNews

Apr 10, 2025

Последние атаки GOFFEE: новые инструменты и методы | Securelist

Инструмент для кражи файлов со съемных носителей. Вариант FlashFileGrabberOffline ищет файлы с заданными расширениями на USB-носителях и копирует их локально; основной вариант также может отправлять файлы на командный сервер.

securelistNews

May 13, 2021

GOFFEE’s recent attacks: new tools and techniques | Securelist

A file theft tool focused on removable media. FlashFileGrabberOffline copies files with selected extensions from removable drives to local storage and tracks metadata to avoid duplicates, while FlashFileGrabber adds the ability to send stolen files to the C2 server.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.