Procedure examples

Bisonal has the capability to download files to execute on the victim’s machine.

S-Type can download additional files onto a compromised host.

SeaDuke is capable of uploading and downloading files.

Remsec contains a network loader to receive executable modules from remote attackers and run them on the local victim. It can also upload and download files over HTTP and HTTPS.

Explosive has a function to download a file to the infected system.

Xbash can download additional malicious files from its C2 server.

LightNeuron has the ability to download and execute additional files.

Peppy can download and execute remote files.

Cuba can download files from its C2 server.

DEATHRANSOM can download files to a compromised host.

PureCrypter can download additional payloads for execution on the compromised host.

DarkGate retrieves cryptocurrency mining payloads and commands in encrypted traffic from its command and control server. DarkGate uses Windows Batch scripts executing the curl command to retrieve follow-on payloads. DarkGate has stolen `sitemanager.xml` and `recentservers.xml` from `%APPDATA%\FileZilla\` if present.

Mongall can download files to targeted systems.

NanHaiShu can download additional files from URLs.

SVCReady has the ability to download additional tools such as the RedLine Stealer to an infected host.

ThiefQuest can download and execute payloads in-memory or from disk.

FoggyWeb can receive additional malicious components from an actor controlled C2 server and execute them on a compromised AD FS server.

Hydraq creates a backdoor through which remote attackers can download files and additional malware components.

SHARPSTATS has the ability to upload and download files.

CreepyDrive can download files to the compromised host.

Caterpillar WebShell has a module to download and upload files to the system.

Operators deploying Netwalker have used psexec and certutil to retrieve the Netwalker payload.

Elise can download additional files from the C2 server for execution.

Gazer can execute a task to download a file.

TSCookie has the ability to upload and download files to and from the infected host.

Latrodectus can download and execute PEs, DLLs, and shellcode from C2.

Saint Bot can download additional files onto a compromised host.

Chaes can download additional files onto an infected machine.

LODEINFO has the ability to download additional files from the C2.

Briba downloads files onto infected hosts.

CharmPower has the ability to download additional modules to a compromised host.

MuddyViper has the ability to download files from the C2 server. Additionally, MuddyViper has the ability to download a file in chunks with sleep time between each chunk.

TYPEFRAME can upload and download files to the victim’s machine.

Bundlore can download and execute new versions of itself.

P8RAT can download additional payloads to a target system.

EVILNUM can download and upload files to the victim's computer.

SMOKEDHAM has used Powershell to download UltraVNC and ngrok from third-party file sharing sites.

TAINTEDSCRIBE can download additional modules from its C2 server.

BendyBear is designed to download an implant from a C2 server.

GlassWorm has downloaded additional payloads from C2.

Uroburos can use a `Put` command to write files to an infected machine.

Metamorfo has used MSI files to download additional files to execute.

Spica can upload and download files to and from compromised hosts.

Trojan.Karagany can upload, download, and execute files on the victim.

Bandook can download files to the system.

PipeMon can install additional modules via C2 commands.

MagicRAT can import and execute additional payloads.

KONNI can download files and execute them on the victim’s machine.

Winnti for Linux has the ability to deploy modules directly from command and control (C2) servers, possibly for remote command execution, file exfiltration, and socks5 proxying on the infected host.

gh0st RAT can download files to the victim’s machine.