Procedure examples

BISCUIT has a command to download a file from the C2 server.

Calisto has the capability to upload and download files to the victim's machine.

Solar has the ability to download and execute files.

Pisloader has a command to upload a file to the victim machine.

GoldenSpy constantly attempts to download and execute files from the remote C2, including GoldenSpy itself if not found on the system.

Gold Dragon can download additional components from the C2 server.

RGDoor uploads and downloads files to and from the victim’s machine.

Neo-reGeorg has the ability to download files to targeted systems.

The AshTag stager component can retrieve and execute the main payload.

Carberp can download and execute new plugins from the C2 server.

Revenge RAT has the ability to upload and download files.

MacMa has downloaded additional files, including an exploit for used privilege escalation.

FunnyDream can download additional files onto a compromised host.

More_eggs can download and launch additional payloads.

SysUpdate has the ability to download files to a compromised host.

OutSteel can download files from its C2 server.

BackConfig can download and execute additional payloads on a compromised host.

Kwampirs downloads additional files from C2 servers.

Nerex creates a backdoor through which remote attackers can download files onto a compromised host.

BoomBox has the ability to download next stage malware components to a compromised system.

WIREFIRE has the ability to download files to compromised devices.

Kessel can download additional modules from the C2 server.

GrimAgent has the ability to download and execute additional payloads.

STEADYPULSE can add lines to a Perl script on a targeted server to import additional Perl modules.

PHASEJAM has the ability to upload files onto the compromised appliance.

YAHOYAH uses HTTP GET requests to download other files that are executed in memory.

Lokibot downloaded several staged items onto the victim's machine.

CallMe has the capability to download a file to the victim from the C2 server.

CloudDuke downloads and executes additional malware from either a Web address or a Microsoft OneDrive account.

Egregor has the ability to download files from its C2 server.

PoetRAT has the ability to copy files and download/upload files into C2 channels using FTP and HTTPS.

CHOPSTICK is capable of performing remote file transmission.

FELIXROOT downloads and uploads files to and from the victim’s machine.

ZxShell has a command to transfer files from a remote host.

RIFLESPINE can download and execute files.

RAPIDPULSE can transfer files to and from compromised hosts.

NDiskMonitor can download and execute a file from given URL.

CoinTicker executes a Python script to download its second stage.

DDKONG downloads and uploads files on the victim’s machine.

Penquin can execute the command code do_download to retrieve remote files from C2.

BabyShark has downloaded additional files from the C2.

Cannon can download a payload for execution.

build_downer has the ability to download files from C2 to the infected host.

Melcoz has the ability to download additional files to a compromised host.

The Winnti for Windows dropper can place malicious payloads on targeted systems.

PowerPunch can download payloads from adversary infrastructure.

BONDUPDATER can download or upload files from its C2 server.

Kinsing has downloaded additional lateral movement scripts from C2.

Meteor has the ability to download additional files for execution on the victim's machine.

njRAT can download files to the victim’s machine. APT-C-36 has used modified versions of njRAT to enable the download of .NET assemblies.