Procedure examples

Mivast has the capability to download and execute .exe files.

HiddenWasp downloads a tar compressed archive from a download server to the system.

WarzoneRAT can download and execute additional files.

SLOTHFULMEDIA has downloaded files onto a victim machine.

XORIndex Loader has been used to download a malicious payload to include BeaverTail.

Small Sieve has the ability to download files.

RemoteUtilities can upload and download files to and from a target machine.

certutil can be used to download files from a given URL.

ShimRatReporter had the ability to download additional payloads.

Sliver can download additional content and files from the Sliver server to the client residing on the victim machine using the upload command.

SILENTTRINITY can load additional files and tools, including Mimikatz.

Empire can upload and download to and from a victim machine.

CSPY Downloader can download additional tools to a compromised host.

CARROTBALL has the ability to download and install a remote payload.

BITSAdmin can be used to create BITS Jobs to upload and/or download files.

AsyncRAT has the ability to download files including over SFTP.

Brute Ratel C4 can download files to compromised hosts.

Remcos can upload and download files to and from the victim’s machine.

MCMD can upload additional files to a compromised host.

Donut can download and execute previously staged shellcode payloads.

cmd can be used to copy files to/from a remotely connected external system.

esentutl can be used to copy files from a given URL.

Koadic can download additional files and tools.

Pupy can upload and download to/from a victim machine.

ftp may be abused by adversaries to transfer tools or files from an external system into a compromised environment.

QuasarRAT can download files to the victim’s machine and execute them.

TeamPCP Cloud Stealer has the ability to download additional payloads to targeted systems.

Mini Shai-Hulud has the ability to download additional payloads from adversary controlled or compromised infrastructure.

CanisterWorm has downloaded and executed binaries from dead drop URLs retrieved from ICP canister C2 nodes. CanisterWorm has also downloaded kubectl to compromised environments if it was not already installed.

BADFLICK has download files from its C2 server.

TrickBot uses the Windows API call, CreateProcessW(), to manage execution flow. TrickBot has also used Nt* API functions to perform Process Injection.

The Ninja loader can call Windows APIs for discovery, process injection, and payload decryption.

Pikabot uses native Windows APIs to determine if the process is being debugged and analyzed, such as `CheckRemoteDebuggerPresent`, `NtQueryInformationProcess`, `ProcessDebugPort`, and `ProcessDebugFlags`. Other Pikabot variants populate a global list of Windows API addresses from the `NTDLL` and `KERNEL32` libraries, and references these items instead of calling the API items to obfuscate execution.

RCSession can use WinSock API for communication including WSASend and WSARecv.

SynAck parses the export tables of system DLLs to locate and call various Windows API functions.

Bumblebee can use multiple Native APIs.

Amadey has used a variety of Windows API calls, including `GetComputerNameA`, `GetUserNameA`, and `CreateProcessA`.

RDFSNIFFER has used several Win32 API functions to interact with the victim machine.

Torisma has used various Windows API calls.

Stuxnet uses the SetSecurityDescriptorDacl API to reduce object integrity levels.

When executing with non-root permissions, RotaJakiro uses the the `shmget` API to create shared memory between other known RotaJakiro processes. RotaJakiro also uses the `execvp` API to help its dead process "resurrect".

AvosLocker has used a variety of Windows API calls, including `NtCurrentPeb` and `GetLogicalDrives`.

PAKLOG has used Windows API `SetWindowsHookExW` with `idHook` set to `WH_KEYBOARD_LL` and a custom hook procedure to support its keylogging functions.

Sardonic has the ability to call Win32 API functions to determine if `powershell.exe` is running.

WindTail can invoke Apple APIs contentsOfDirectoryAtPath, pathExtension, and (string) compare.

Misdat has used Windows APIs, including `ExitWindowsEx` and `GetKeyboardType`.

HAWKBALL has leveraged several Windows API calls to create processes, gather disk information, and detect debugger activity.

HeartCrypt can use Windows API functions to modify the Registry and `FindResourceW`, `LoadResource`, and `LockResource` to acquire a pointer to corresponding code resources.

Ursnif has used CreateProcessW to create child processes.

Havoc can use `NtAllocateVirtualMemory` and `NtCreateThreadEx` to aid process injection.