Procedure examples

Shamoon can download an executable to run on the victim.

DnsSystem can download files to compromised systems after receiving a command with the string `downloaddd`.

MoleNet can download additional payloads from the C2.

JHUHUGIT can retrieve an additional payload from its C2 server. JHUHUGIT has a command to download files to the victim’s machine.

BLUELIGHT can download additional files onto the host.

KGH_SPY has the ability to download and execute code from remote servers.

down_new has the ability to download files to the compromised host.

Ixeshe can download and execute additional files.

Micropsia can download and execute an executable from the C2 server.

Kerrdown can download specific payloads to a compromised host based on OS architecture.

RARSTONE downloads its backdoor component from a C2 server and loads it directly into memory.

RedLine Stealer has the ability download additional payloads.

VBShower has the ability to download VBS files to the target computer.

StoneDrill has downloaded and dropped temporary files containing scripts; it additionally has a function to upload files from the victims machine.

OopsIE can download files from its C2 server to the victim's machine.

RogueRobin can save a new file to the system from the C2 server.

Attor can download additional plugins, updates and other files.

SQLRat can make a direct SQL connection to a Microsoft database controlled by the attackers, retrieve an item from the bindata table, then write and execute the file on disk.

LitePower has the ability to download payloads containing system commands to a compromised host.

BoxCaon can download files.

NightClub can load multiple additional plugins on an infected host.

SDBbot has the ability to download a DLL from C2 to a compromised host.

Mosquito can upload and download files to the victim.

RTM can download additional files.

PHPsert has the ability to retrieve remote payloads.

SodaMaster has the ability to download additional payloads from C2 to the targeted system.

Hikit has the ability to download files to a compromised host.

StrelaStealer installers have used obfuscated PowerShell scripts to retrieve follow-on payloads from WebDAV servers.

Grandoreiro can download its second stage from a hardcoded URL within the loader's code.

WellMail can receive data and executable scripts from C2.

LiteDuke has the ability to download files.

Sakula has the capability to download files.

VaporRage has the ability to download malicious shellcode to compromised systems.

Sibot can download and execute a payload onto a compromised system.

ZxxZ can download and execute additional files.

Caminho has the ability to download files onto compromised hosts.

Drovorub can download files to a compromised host.

Shark can download additional files from its C2 via HTTP or DNS.

Bazar can download and deploy additional payloads, including ransomware and post-exploitation frameworks such as Cobalt Strike.

BadPatch can download and execute or update malware.

RATANKBA uploads and downloads information.

Nidiran can download and execute files.

HiddenFace can download files from the C2 to victim systems.

Cryptoistic has the ability to send and receive files.

ABK has the ability to download files from C2.

OilCheck can download staged payloads from an actor-controlled infrastructure.

Zebrocy obtains additional code to execute on the victim's machine, including the downloading of a secondary payload.

Pandora can load additional drivers and files onto a victim machine.

SpeakUp downloads and executes additional files from a remote server.

Cobalt Strike can deliver additional payloads to victim machines.