Procedure examples

WarzoneRAT can download and execute additional files.

SLOTHFULMEDIA has downloaded files onto a victim machine.

XORIndex Loader has been used to download a malicious payload to include BeaverTail.

Small Sieve has the ability to download files.

RemoteUtilities can upload and download files to and from a target machine.

certutil can be used to download files from a given URL.

ShimRatReporter had the ability to download additional payloads.

Sliver can download additional content and files from the Sliver server to the client residing on the victim machine using the upload command.

SILENTTRINITY can load additional files and tools, including Mimikatz.

Empire can upload and download to and from a victim machine.

CSPY Downloader can download additional tools to a compromised host.

CARROTBALL has the ability to download and install a remote payload.

BITSAdmin can be used to create BITS Jobs to upload and/or download files.

AsyncRAT has the ability to download files including over SFTP.

Brute Ratel C4 can download files to compromised hosts.

Remcos can upload and download files to and from the victim’s machine.

MCMD can upload additional files to a compromised host.

Donut can download and execute previously staged shellcode payloads.

cmd can be used to copy files to/from a remotely connected external system.

esentutl can be used to copy files from a given URL.

Koadic can download additional files and tools.

Pupy can upload and download to/from a victim machine.

ftp may be abused by adversaries to transfer tools or files from an external system into a compromised environment.

QuasarRAT can download files to the victim’s machine and execute them.

TeamPCP Cloud Stealer has the ability to download additional payloads to targeted systems.

Mini Shai-Hulud has the ability to download additional payloads from adversary controlled or compromised infrastructure.

CanisterWorm has downloaded and executed binaries from dead drop URLs retrieved from ICP canister C2 nodes. CanisterWorm has also downloaded kubectl to compromised environments if it was not already installed.

TeamPCP has modified legitimate software binaries to retrieve secondary payloads from C2.

ShinyHunters has deployed custom scripts to targeted systems from customized MeshAgents in their staging environment.

BADFLICK has download files from its C2 server.

During Operation Dream Job, Lazarus Group used Windows API `ObtainUserAgentString` to obtain the victim's User-Agent and used the value to connect to their C2 server.

During Operation Sharpshooter, the first stage downloader resolved various Windows libraries and APIs, including `LoadLibraryA()`, `GetProcAddress()`, and `CreateProcessA()`.

During Operation Honeybee, the threat actors deployed malware that used API calls, including `CreateProcessAsUser`.

During Operation Digital Eye, threat actors used native API such as `GetUserInfo`.

During Operation Wocao, threat actors used the `CreateProcessA` and `ShellExecute` API functions to launch commands after being injected into a selected process.

APT38 has used the Windows API to execute code within a victim's system.

SideCopy has executed malware by calling the API function `CreateProcessW`.

Kimsuky has utilized Native APIs to collect data from victim hosts and facilitate execution of malicious scripts.

Gorgon Group malware can leverage the Windows API call, CreateProcessA(), for execution.

menuPass has used native APIs including GetModuleFileName, lstrcat, CreateFile, and ReadFile.

Gamaredon Group malware has used CreateProcess to launch additional malicious components.

Sandworm Team uses Prestige to disable and restore file system redirection by using the following functions: `Wow64DisableWow64FsRedirection()` and `Wow64RevertWow64FsRedirection()`.

Mustang Panda has used various Windows API calls during execution and defense evasion.

APT37 leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.

Higaisa has called various native OS APIs.

Tropic Trooper has used multiple Windows APIs including HttpInitialize, HttpCreateHttpHandle, and HttpAddUrl.

BlackTech has used built-in API functions.

Turla and its RPC backdoors have used APIs calls for various tasks related to subverting AMSI and accessing then executing commands through RPC and/or named pipes.

TA505 has deployed payloads that use Windows API calls on a compromised host.

Chimera has used direct Windows system calls by leveraging Dumpert.