Procedure examples

DRATzarus can deploy additional tools onto an infected machine.

ShimRat can download additional files.

Chrommme can download its code from C2.

Conficker downloads an HTTP server to the infected machine.

SocGholish can download additional malware to infected hosts.

Flagpro can download additional malware from the C2 server.

Hi-Zor has the ability to upload and download files from its C2 server.

SpicyOmelette can download malicious files from threat actor controlled AWS URL's.

China Chopper's server component can download remote files.

On macOS, LightSpy downloads a `.json` file from the C2 server. The `.json` file contains metadata about the plugins to be downloaded, including their URL, name, version, and MD5 hash. LightSpy retrieves the plugins specified in the `.json` file, which are compiled `.dylib` files. These `.dylib` files provide task and platform specific functionality. LightSpy also imports open-source libraries to manage socket connections.

PUNCHBUGGY can download additional files and payloads to compromised hosts.

GoldMax can download and execute additional files.

CostaBricks has been used to load SombRAT onto a compromised host.

KeyBoy has a download and upload functionality.

POSHSPY downloads and executes additional PowerShell code and Windows binaries.

MiniDuke can download additional encrypted backdoors onto the victim via GIF files.

HyperBro has the ability to download additional files.

Anchor can download additional payloads.

Pteranodon can download and execute additional files.

DarkTortilla can download additional packages for keylogging, cryptocurrency mining, and other capabilities; it can also retrieve malicious payloads such as Agent Tesla, AsyncRat, NanoCore, RedLine, Cobalt Strike, and Metasploit.

BeaverTail has been used to download a malicious payload to include Python based malware InvisibleFerret.

ROKRAT can retrieve additional malicious payloads from its C2 server.

CORESHELL downloads another dropper from its C2 server.

Dyre has a command to download and executes additional files.

BlackMould has the ability to download files to the victim's machine.

Javali can download payloads from remote C2 servers.

PlugX has a module to download and execute files on the compromised machine.

Bisonal has the capability to download files to execute on the victim’s machine.

S-Type can download additional files onto a compromised host.

SeaDuke is capable of uploading and downloading files.

Remsec contains a network loader to receive executable modules from remote attackers and run them on the local victim. It can also upload and download files over HTTP and HTTPS.

Explosive has a function to download a file to the infected system.

Xbash can download additional malicious files from its C2 server.

LightNeuron has the ability to download and execute additional files.

Peppy can download and execute remote files.

Cuba can download files from its C2 server.

DEATHRANSOM can download files to a compromised host.

PureCrypter can download additional payloads for execution on the compromised host.

DarkGate retrieves cryptocurrency mining payloads and commands in encrypted traffic from its command and control server. DarkGate uses Windows Batch scripts executing the curl command to retrieve follow-on payloads. DarkGate has stolen `sitemanager.xml` and `recentservers.xml` from `%APPDATA%\FileZilla\` if present.

Mongall can download files to targeted systems.

NanHaiShu can download additional files from URLs.

SVCReady has the ability to download additional tools such as the RedLine Stealer to an infected host.

ThiefQuest can download and execute payloads in-memory or from disk.

FoggyWeb can receive additional malicious components from an actor controlled C2 server and execute them on a compromised AD FS server.

Hydraq creates a backdoor through which remote attackers can download files and additional malware components.

SHARPSTATS has the ability to upload and download files.

CreepyDrive can download files to the compromised host.

Caterpillar WebShell has a module to download and upload files to the system.

Operators deploying Netwalker have used psexec and certutil to retrieve the Netwalker payload.

Elise can download additional files from the C2 server for execution.