Procedure examples

Emissary has the capability to download files from the C2 server.

Exaramel for Linux has a command to download a file from and to a remote C2 server.

KEYMARBLE can upload files to the victim’s machine and can download additional payloads.

TAMECAT has used `wget` and `curl` to download additional content.

CostaBricks can download additional payloads onto a compromised host.

Ursnif has dropped payload and configuration files to disk. Ursnif has also been used to download and execute additional payloads.

CASTLETAP can transfer files to compromised network devices.

ThreatNeedle can download additional tools to enable lateral movement.

ZLib has the ability to download files.

RedLeaves is capable of downloading a file from a specified URL.

POWERSOURCE has been observed being used to download TEXTMATE and the Cobalt Strike Beacon payload onto victims.

Tsundere Botnet’s loader component has downloaded the zip file node-v18.17.0-win-x64.zip from the official Node.js website, as well as pm2, a Node.js process management tool.

Felismus can download files from remote servers.

Zeus Panda can download additional malware plug-in modules and execute them on the victim’s machine.

Havoc has the ability to upload files to infected systems.

CARROTBAT has the ability to download and execute a remote file via certutil.

WEBC2 can download and execute a file.

InvisibleFerret has downloaded “AnyDesk.exe” into the user’s home directory from the C2 server when checks for the service fail to identify its presence in the victim environment. InvisibleFerret has also been configured to download additional payloads using a command which calls to the /bow URI.

Bankshot uploads files and secondary payloads to the victim's machine.

SharpDisco has been used to download a Python interpreter to `C:\Users\Public\WinTN\WinTN.exe` as well as other plugins from external sources.

StrongPity can download files to specified targets.

can download and execute a second-stage payload.

xCaon has a command to download files to the victim's machine.

PLAINTEE has downloaded and executed additional plugins.

Pony can download additional files onto the infected system.

Nebulae can download files from C2.

AuditCred can download files and additional malware.

TONESHELL has the ability to download additional files to the victim device.

Kasidet has the ability to download and execute additional files.

Hannotog can download additional files to the victim machine.

RainyDay can download files to a compromised host.

Ecipekac can download additional payloads to a compromised host.

BUSHWALK can write malicious payloads sent through a web request’s command parameter.

macOS.OSAMiner has used `curl` to download a Stripped Payloads from a public facing adversary-controlled webpage.

LOWBALL uses the Dropbox API to request two files, one of which is the same file as the one dropped by the malicious email attachment. This is most likely meant to be a mechanism to update the compromised host with a new version of the LOWBALL malware.

NETWIRE can downloaded payloads from C2 to the compromised host.

TinyTurla has the ability to act as a second-stage dropper used to infect the system with additional malware.

PowerExchange can decode Base64-encoded files and call `WriteAllBytes` to write the files to compromised hosts.

IMAPLoader is a loader used to retrieve follow-on payload encoded in email messages for execution on victim systems.

GreyEnergy can download additional modules and payloads.

Aria-body has the ability to download additional payloads from C2.

Emotet can download follow-on payloads and items via malicious `url` parameters in obfuscated PowerShell code.

Crimson contains a command to retrieve files from its C2 server.

Tomiris can download files and execute them on a victim's system.

DUSTTRAP can retrieve and load additional payloads.

Turian can download additional files and tools from its C2.

BADHATCH has the ability to load a second stage malicious DLL file onto a compromised machine.

Machete can download additional files for execution on the victim’s machine.

PowerLess can download additional payloads to a compromised host.

Action RAT has the ability to download additional payloads onto an infected machine.