Procedure examples

P.A.S. Webshell can upload and download files to and from compromised hosts.

Volgmer can download remote files and additional payloads to the victim's machine.

WhisperGate can download additional stages of malware from a Discord CDN channel.

ZeroT can download additional payloads onto the victim.

RDAT can download files via DNS.

Skidmap has the ability to download files on an infected host.

Okrum has built-in commands for uploading, downloading, and executing files to the system.

Bonadan can download additional modules from the C2 server.

Neoichor can download additional files onto a compromised host.

Raspberry Robin retrieves its second stage payload in a variety of ways such as through msiexec.exe abuse, or running the curl command to download the payload to the victim's %AppData% folder.

RemoteCMD copies a file over to the remote system before execution.

Diavol can receive configuration updates and additional payloads including wscpy.exe from C2.

Doki has downloaded scripts from C2.

IcedID has the ability to download additional modules and a configuration file from C2.

VERMIN can download and upload files to the victim's machine.

UBoatRAT can upload and download files to the victim’s machine.

HTTPTroy has the ability to download files from C2 using the `down <FILENAME>` command.

MarkiRAT can download additional files and tools from its C2 server, including through the use of BITSAdmin.

Kazuar downloads additional plug-ins to load on the victim’s machine, including the ability to upgrade and replace its own binary.

NavRAT can download files remotely.

DarkComet can load any files onto the infected machine to execute.

CHIMNEYSWEEP can download additional files from C2.

Lucifer can download and execute a replica of itself using certutil.

DRATzarus can deploy additional tools onto an infected machine.

ShimRat can download additional files.

Chrommme can download its code from C2.

Conficker downloads an HTTP server to the infected machine.

SocGholish can download additional malware to infected hosts.

Flagpro can download additional malware from the C2 server.

Hi-Zor has the ability to upload and download files from its C2 server.

SpicyOmelette can download malicious files from threat actor controlled AWS URL's.

China Chopper's server component can download remote files.

On macOS, LightSpy downloads a `.json` file from the C2 server. The `.json` file contains metadata about the plugins to be downloaded, including their URL, name, version, and MD5 hash. LightSpy retrieves the plugins specified in the `.json` file, which are compiled `.dylib` files. These `.dylib` files provide task and platform specific functionality. LightSpy also imports open-source libraries to manage socket connections.

PUNCHBUGGY can download additional files and payloads to compromised hosts.

GoldMax can download and execute additional files.

CostaBricks has been used to load SombRAT onto a compromised host.

KeyBoy has a download and upload functionality.

POSHSPY downloads and executes additional PowerShell code and Windows binaries.

MiniDuke can download additional encrypted backdoors onto the victim via GIF files.

HyperBro has the ability to download additional files.

Anchor can download additional payloads.

Pteranodon can download and execute additional files.

DarkTortilla can download additional packages for keylogging, cryptocurrency mining, and other capabilities; it can also retrieve malicious payloads such as Agent Tesla, AsyncRat, NanoCore, RedLine, Cobalt Strike, and Metasploit.

BeaverTail has been used to download a malicious payload to include Python based malware InvisibleFerret.

ROKRAT can retrieve additional malicious payloads from its C2 server.

CORESHELL downloads another dropper from its C2 server.

Dyre has a command to download and executes additional files.

BlackMould has the ability to download files to the victim's machine.

Javali can download payloads from remote C2 servers.

PlugX has a module to download and execute files on the compromised machine.