Procedure examples

Avenger has the ability to download files from C2 to a compromised host.

PUBLOAD has acted as a stager that can download the next-stage payload from its C2 server. PUBLOAD has also delivered FDMTP as a secondary control tool and PTSOCKET for exfiltration to some infected systems.

SystemBC has downloaded additional files for execution on the victim’s machine. The server component of SystemBC has the ability to send additional files to victim machines.

Gootloader can fetch second stage code from hardcoded web domains.

WellMess can write files to a compromised host.

Dacls can download its payload from a C2 server.

DropBook can download and execute additional files.

Woody RAT can download files from its C2 server, including the .NET DLLs, `WoodySharpExecutor` and `WoodyPowerSession`.

Mafalda can download additional files onto the compromised host.

KARAE can upload and download files, including second-stage malware.

Squirrelwaffle has downloaded and executed additional encoded payloads.

PolyglotDuke can retrieve payloads from the C2 server.

HexEval Loader has been used to download a malicious payload to include BeaverTail.

Hildegard has downloaded additional scripts that build and run Monero cryptocurrency miners.

Agent.btz attempts to download an encrypted binary from a specified domain.

SLOWDRIFT downloads additional payloads.

SHUTTERSPEED can download and execute an arbitary executable.

SombRAT has the ability to download and execute additional payloads.

ODAgent has the ability to download and execute files on compromised systems.

FlawedAmmyy can transfer files from C2.

Snip3 can download additional payloads to compromised systems.

FYAnti can download additional payloads to a compromised host.

HOPLIGHT has the ability to connect to a remote host in order to upload and download files.

GuLoader can download further malware for execution on the victim's machine.

MobileOrder has a command to download a file from the C2 server to the victim mobile device's SD card.

RegDuke can download files from C2.

InvisiMole can upload files to the victim's machine for operations.

P.A.S. Webshell can upload and download files to and from compromised hosts.

Volgmer can download remote files and additional payloads to the victim's machine.

WhisperGate can download additional stages of malware from a Discord CDN channel.

ZeroT can download additional payloads onto the victim.

RDAT can download files via DNS.

Skidmap has the ability to download files on an infected host.

Okrum has built-in commands for uploading, downloading, and executing files to the system.

Bonadan can download additional modules from the C2 server.

Neoichor can download additional files onto a compromised host.

Raspberry Robin retrieves its second stage payload in a variety of ways such as through msiexec.exe abuse, or running the curl command to download the payload to the victim's %AppData% folder.

RemoteCMD copies a file over to the remote system before execution.

Diavol can receive configuration updates and additional payloads including wscpy.exe from C2.

Doki has downloaded scripts from C2.

IcedID has the ability to download additional modules and a configuration file from C2.

VERMIN can download and upload files to the victim's machine.

UBoatRAT can upload and download files to the victim’s machine.

HTTPTroy has the ability to download files from C2 using the `down <FILENAME>` command.

MarkiRAT can download additional files and tools from its C2 server, including through the use of BITSAdmin.

Kazuar downloads additional plug-ins to load on the victim’s machine, including the ability to upgrade and replace its own binary.

NavRAT can download files remotely.

DarkComet can load any files onto the infected machine to execute.

CHIMNEYSWEEP can download additional files from C2.

Lucifer can download and execute a replica of itself using certutil.