Procedure examples

Gazer can execute a task to download a file.

TSCookie has the ability to upload and download files to and from the infected host.

Latrodectus can download and execute PEs, DLLs, and shellcode from C2.

Saint Bot can download additional files onto a compromised host.

Chaes can download additional files onto an infected machine.

LODEINFO has the ability to download additional files from the C2.

Briba downloads files onto infected hosts.

CharmPower has the ability to download additional modules to a compromised host.

MuddyViper has the ability to download files from the C2 server. Additionally, MuddyViper has the ability to download a file in chunks with sleep time between each chunk.

TYPEFRAME can upload and download files to the victim’s machine.

Bundlore can download and execute new versions of itself.

P8RAT can download additional payloads to a target system.

EVILNUM can download and upload files to the victim's computer.

SMOKEDHAM has used Powershell to download UltraVNC and ngrok from third-party file sharing sites.

TAINTEDSCRIBE can download additional modules from its C2 server.

BendyBear is designed to download an implant from a C2 server.

GlassWorm has downloaded additional payloads from C2.

Uroburos can use a `Put` command to write files to an infected machine.

Metamorfo has used MSI files to download additional files to execute.

Spica can upload and download files to and from compromised hosts.

Trojan.Karagany can upload, download, and execute files on the victim.

Bandook can download files to the system.

PipeMon can install additional modules via C2 commands.

MagicRAT can import and execute additional payloads.

KONNI can download files and execute them on the victim’s machine.

Winnti for Linux has the ability to deploy modules directly from command and control (C2) servers, possibly for remote command execution, file exfiltration, and socks5 proxying on the infected host.

gh0st RAT can download files to the victim’s machine.

Shamoon can download an executable to run on the victim.

DnsSystem can download files to compromised systems after receiving a command with the string `downloaddd`.

MoleNet can download additional payloads from the C2.

JHUHUGIT can retrieve an additional payload from its C2 server. JHUHUGIT has a command to download files to the victim’s machine.

BLUELIGHT can download additional files onto the host.

KGH_SPY has the ability to download and execute code from remote servers.

down_new has the ability to download files to the compromised host.

Ixeshe can download and execute additional files.

Micropsia can download and execute an executable from the C2 server.

Kerrdown can download specific payloads to a compromised host based on OS architecture.

RARSTONE downloads its backdoor component from a C2 server and loads it directly into memory.

RedLine Stealer has the ability download additional payloads.

VBShower has the ability to download VBS files to the target computer.

StoneDrill has downloaded and dropped temporary files containing scripts; it additionally has a function to upload files from the victims machine.

OopsIE can download files from its C2 server to the victim's machine.

RogueRobin can save a new file to the system from the C2 server.

Attor can download additional plugins, updates and other files.

SQLRat can make a direct SQL connection to a Microsoft database controlled by the attackers, retrieve an item from the bindata table, then write and execute the file on disk.

LitePower has the ability to download payloads containing system commands to a compromised host.

BoxCaon can download files.

NightClub can load multiple additional plugins on an infected host.

SDBbot has the ability to download a DLL from C2 to a compromised host.

Mosquito can upload and download files to the victim.