Procedure examples

TONESHELL has the ability to download additional files to the victim device.

Kasidet has the ability to download and execute additional files.

Hannotog can download additional files to the victim machine.

RainyDay can download files to a compromised host.

Ecipekac can download additional payloads to a compromised host.

BUSHWALK can write malicious payloads sent through a web request’s command parameter.

macOS.OSAMiner has used `curl` to download a Stripped Payloads from a public facing adversary-controlled webpage.

LOWBALL uses the Dropbox API to request two files, one of which is the same file as the one dropped by the malicious email attachment. This is most likely meant to be a mechanism to update the compromised host with a new version of the LOWBALL malware.

NETWIRE can downloaded payloads from C2 to the compromised host.

TinyTurla has the ability to act as a second-stage dropper used to infect the system with additional malware.

PowerExchange can decode Base64-encoded files and call `WriteAllBytes` to write the files to compromised hosts.

IMAPLoader is a loader used to retrieve follow-on payload encoded in email messages for execution on victim systems.

GreyEnergy can download additional modules and payloads.

Aria-body has the ability to download additional payloads from C2.

Emotet can download follow-on payloads and items via malicious `url` parameters in obfuscated PowerShell code.

Crimson contains a command to retrieve files from its C2 server.

Tomiris can download files and execute them on a victim's system.

DUSTTRAP can retrieve and load additional payloads.

Turian can download additional files and tools from its C2.

BADHATCH has the ability to load a second stage malicious DLL file onto a compromised machine.

Machete can download additional files for execution on the victim’s machine.

PowerLess can download additional payloads to a compromised host.

Action RAT has the ability to download additional payloads onto an infected machine.

Avenger has the ability to download files from C2 to a compromised host.

PUBLOAD has acted as a stager that can download the next-stage payload from its C2 server. PUBLOAD has also delivered FDMTP as a secondary control tool and PTSOCKET for exfiltration to some infected systems.

SystemBC has downloaded additional files for execution on the victim’s machine. The server component of SystemBC has the ability to send additional files to victim machines.

Gootloader can fetch second stage code from hardcoded web domains.

WellMess can write files to a compromised host.

Dacls can download its payload from a C2 server.

DropBook can download and execute additional files.

Woody RAT can download files from its C2 server, including the .NET DLLs, `WoodySharpExecutor` and `WoodyPowerSession`.

Mafalda can download additional files onto the compromised host.

KARAE can upload and download files, including second-stage malware.

Squirrelwaffle has downloaded and executed additional encoded payloads.

PolyglotDuke can retrieve payloads from the C2 server.

HexEval Loader has been used to download a malicious payload to include BeaverTail.

Hildegard has downloaded additional scripts that build and run Monero cryptocurrency miners.

Agent.btz attempts to download an encrypted binary from a specified domain.

SLOWDRIFT downloads additional payloads.

SHUTTERSPEED can download and execute an arbitary executable.

SombRAT has the ability to download and execute additional payloads.

ODAgent has the ability to download and execute files on compromised systems.

FlawedAmmyy can transfer files from C2.

Snip3 can download additional payloads to compromised systems.

FYAnti can download additional payloads to a compromised host.

HOPLIGHT has the ability to connect to a remote host in order to upload and download files.

GuLoader can download further malware for execution on the victim's machine.

MobileOrder has a command to download a file from the C2 server to the victim mobile device's SD card.

RegDuke can download files from C2.

InvisiMole can upload files to the victim's machine for operations.