Procedure examples

SampleCheck5000 can download additional payloads to compromised hosts.

SUNBURST delivered different payloads, including TEARDROP in at least one instance.

EvilBunny has downloaded additional Lua scripts from the C2.

HotCroissant has the ability to upload a file from the command and control (C2) server to the victim machine.

ServHelper may download additional files to execute.

Unknown Logger is capable of downloading remote files.

REvil can download a copy of itself from an attacker controlled IP address to the victim machine.

Valak has downloaded a variety of modules and payloads to the compromised host, including IcedID and NetSupport Manager RAT-based malware.

Samurai has been used to deploy other malware including Ninja.

Milan has received files from C2 and stored them in log folders beginning with the character sequence `a9850d2f`.

OSX_OCEANLOTUS.D has a command to download and execute a file on the victim’s machine.

OilBooster can download and execute files from an actor-controlled OneDrive account.

Taidoor has downloaded additional files onto a compromised host.

Kivars has the ability to download and execute files.

Cyclops Blink has the ability to download files to target systems.

PoisonIvy creates a backdoor through which remote attackers can upload files.

Seasalt has a command to download additional files.

NanoCore has the capability to download and activate additional modules for execution.

PLEAD has the ability to upload and download files to and from an infected host.

Raccoon Stealer downloads various library files enabling interaction with various data stores and structures to facilitate follow-on information theft.

Daserf can download remote files.

Cardinal RAT can download and execute additional payloads.

DanBot can download additional files to a targeted system.

BISCUIT has a command to download a file from the C2 server.

Calisto has the capability to upload and download files to the victim's machine.

Solar has the ability to download and execute files.

Pisloader has a command to upload a file to the victim machine.

GoldenSpy constantly attempts to download and execute files from the remote C2, including GoldenSpy itself if not found on the system.

Gold Dragon can download additional components from the C2 server.

RGDoor uploads and downloads files to and from the victim’s machine.

Neo-reGeorg has the ability to download files to targeted systems.

The AshTag stager component can retrieve and execute the main payload.

Carberp can download and execute new plugins from the C2 server.

Revenge RAT has the ability to upload and download files.

MacMa has downloaded additional files, including an exploit for used privilege escalation.

FunnyDream can download additional files onto a compromised host.

More_eggs can download and launch additional payloads.

SysUpdate has the ability to download files to a compromised host.

OutSteel can download files from its C2 server.

BackConfig can download and execute additional payloads on a compromised host.

Kwampirs downloads additional files from C2 servers.

Nerex creates a backdoor through which remote attackers can download files onto a compromised host.

BoomBox has the ability to download next stage malware components to a compromised system.

WIREFIRE has the ability to download files to compromised devices.

Kessel can download additional modules from the C2 server.

GrimAgent has the ability to download and execute additional payloads.

STEADYPULSE can add lines to a Perl script on a targeted server to import additional Perl modules.

PHASEJAM has the ability to upload files onto the compromised appliance.

YAHOYAH uses HTTP GET requests to download other files that are executed in memory.

Lokibot downloaded several staged items onto the victim's machine.