Procedure examples

RTM can download additional files.

PHPsert has the ability to retrieve remote payloads.

SodaMaster has the ability to download additional payloads from C2 to the targeted system.

Hikit has the ability to download files to a compromised host.

StrelaStealer installers have used obfuscated PowerShell scripts to retrieve follow-on payloads from WebDAV servers.

Grandoreiro can download its second stage from a hardcoded URL within the loader's code.

WellMail can receive data and executable scripts from C2.

LiteDuke has the ability to download files.

Sakula has the capability to download files.

VaporRage has the ability to download malicious shellcode to compromised systems.

Sibot can download and execute a payload onto a compromised system.

ZxxZ can download and execute additional files.

Caminho has the ability to download files onto compromised hosts.

Drovorub can download files to a compromised host.

Shark can download additional files from its C2 via HTTP or DNS.

Bazar can download and deploy additional payloads, including ransomware and post-exploitation frameworks such as Cobalt Strike.

BadPatch can download and execute or update malware.

RATANKBA uploads and downloads information.

Nidiran can download and execute files.

HiddenFace can download files from the C2 to victim systems.

Cryptoistic has the ability to send and receive files.

ABK has the ability to download files from C2.

OilCheck can download staged payloads from an actor-controlled infrastructure.

Zebrocy obtains additional code to execute on the victim's machine, including the downloading of a secondary payload.

Pandora can load additional drivers and files onto a victim machine.

SpeakUp downloads and executes additional files from a remote server.

Cobalt Strike can deliver additional payloads to victim machines.

SampleCheck5000 can download additional payloads to compromised hosts.

SUNBURST delivered different payloads, including TEARDROP in at least one instance.

EvilBunny has downloaded additional Lua scripts from the C2.

HotCroissant has the ability to upload a file from the command and control (C2) server to the victim machine.

ServHelper may download additional files to execute.

Unknown Logger is capable of downloading remote files.

REvil can download a copy of itself from an attacker controlled IP address to the victim machine.

Valak has downloaded a variety of modules and payloads to the compromised host, including IcedID and NetSupport Manager RAT-based malware.

Samurai has been used to deploy other malware including Ninja.

Milan has received files from C2 and stored them in log folders beginning with the character sequence `a9850d2f`.

OSX_OCEANLOTUS.D has a command to download and execute a file on the victim’s machine.

OilBooster can download and execute files from an actor-controlled OneDrive account.

Taidoor has downloaded additional files onto a compromised host.

Kivars has the ability to download and execute files.

Cyclops Blink has the ability to download files to target systems.

PoisonIvy creates a backdoor through which remote attackers can upload files.

Seasalt has a command to download additional files.

NanoCore has the capability to download and activate additional modules for execution.

PLEAD has the ability to upload and download files to and from an infected host.

Raccoon Stealer downloads various library files enabling interaction with various data stores and structures to facilitate follow-on information theft.

Daserf can download remote files.

Cardinal RAT can download and execute additional payloads.

DanBot can download additional files to a targeted system.