While some variations exist in functionalities, the main purpose of these modules is to enumerate all documents on a compromised system and upload them to the C&amp;C server. These file stealers can also download and execute arbitrary code from the C&amp;C server. As with many other tools used by the Gamaredon group, they come in four different coding languages: C/C++, C#, batch file and VBScript