Procedure examples

APT-C-36 has downloaded binary data from a specified domain after the malicious document is opened.

Winnti Group has downloaded an auxiliary program named ff.exe to infected machines.

Tonto Team has downloaded malicious DLLs which served as a ShadowPad loader.

Lazarus Group has downloaded files, malware, and tools from its C2 onto a compromised host.

INC Ransom has downloaded tools to compromised servers including Advanced IP Scanner.

Silence has downloaded additional modules and malware to victim’s machines.

Cobalt Group has used public sites such as github.com and sendspace.com to upload files and then download them to victim computers. The group's JavaScript backdoor is also capable of downloading files.

Wizard Spider can transfer malicious payloads such as ransomware to compromised machines.

Molerats used executables to download malicious files from different sources.

IndigoZebra has downloaded additional files and tools from its C2 server.

Moonstone Sleet retrieved a final stage payload from command and control infrastructure during initial installation on victim systems.

VOID MANTICORE has deployed additional payloads from dedicated C2 servers. VOID MANTICORE has also downloaded legitimate tools and software from publicly available services. VOID MANTICORE had utilized VeraCrypt a legitimate disk encrypting utility that was downloaded directly from the website.

Play has used Cobalt Strike to download files to compromised machines.

HEXANE has downloaded additional payloads and malicious scripts onto a compromised host.

Daggerfly has used PowerShell and BITSAdmin to retrieve follow-on payloads from external locations for execution on victim machines.

Rancor has downloaded additional malware, including by using certutil.

WIRTE has downloaded PowerShell code from the C2 server to be executed.

PLATINUM has transferred files using the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel.

Magic Hound has downloaded additional code and files from servers onto victims.

Ajax Security Team has used Wrapper/Gholee, custom-developed malware, which downloaded additional malware to the infected system.

Threat Group-3390 has downloaded additional malware and tools, including through the use of `certutil`, onto a compromised host .

APT33 has downloaded additional files and programs from its C2 server.

FIN8 has used remote code execution to download subsequent payloads.

FIN13 has downloaded additional tools and malware to compromised systems.

Nomadic Octopus has used malicious macros to download additional files to the victim's machine.

TrickBot downloads several additional files and saves them to the victim's machine.

PowerDuke has a command to download a file.

BLINDINGCAN has downloaded files to a victim machine.

Wiarp creates a backdoor through which remote attackers can download files.

RCSession has the ability to drop additional files to an infected machine.

QuietSieve can download and execute payloads on a target host.

Bumblebee can download and execute additional payloads including through the use of a `Dex` command.

BRICKSTORM has the ability to download files from the Adversaries C2 server to the compromised system.

Amadey can download and execute files to further infect a host machine with additional malware.

NICECURL has the ability to download additional content onto an infected machine, e.g. by using `curl`.

Orz can download files onto the victim.

NOKKI has downloaded a remote module for execution.

Backdoor.Oldrea can download additional modules from C2.

DOGCALL can download and execute additional payloads.

After downloading its main config file, Downdelph downloads multiple payloads from C2 servers.

SEASHARPEE can download remote files onto victims.

POWRUNER can download or upload files from its C2 server.

TDTESS has a command to download and execute an additional file.

SharpStage has the ability to download and execute additional payloads via a DropBox API.

Sardonic has the ability to upload additional malicious files to a compromised machine.

Smoke Loader downloads a new version of itself once it has installed. It also downloads additional plugins.

Misdat is capable of downloading files from the C2.

reGeorg has the ability to download files to targeted systems.

Emissary has the capability to download files from the C2 server.

Exaramel for Linux has a command to download a file from and to a remote C2 server.