Procedure examples

CallMe has the capability to download a file to the victim from the C2 server.

CloudDuke downloads and executes additional malware from either a Web address or a Microsoft OneDrive account.

Egregor has the ability to download files from its C2 server.

PoetRAT has the ability to copy files and download/upload files into C2 channels using FTP and HTTPS.

CHOPSTICK is capable of performing remote file transmission.

FELIXROOT downloads and uploads files to and from the victim’s machine.

ZxShell has a command to transfer files from a remote host.

RIFLESPINE can download and execute files.

RAPIDPULSE can transfer files to and from compromised hosts.

NDiskMonitor can download and execute a file from given URL.

CoinTicker executes a Python script to download its second stage.

DDKONG downloads and uploads files on the victim’s machine.

Penquin can execute the command code do_download to retrieve remote files from C2.

BabyShark has downloaded additional files from the C2.

Cannon can download a payload for execution.

build_downer has the ability to download files from C2 to the infected host.

Melcoz has the ability to download additional files to a compromised host.

The Winnti for Windows dropper can place malicious payloads on targeted systems.

PowerPunch can download payloads from adversary infrastructure.

BONDUPDATER can download or upload files from its C2 server.

Kinsing has downloaded additional lateral movement scripts from C2.

Meteor has the ability to download additional files for execution on the victim's machine.

njRAT can download files to the victim’s machine. APT-C-36 has used modified versions of njRAT to enable the download of .NET assemblies.

ZIPLINE can download files to be saved on the compromised system.

TURNEDUP is capable of downloading additional files.

ChChes is capable of downloading files, including additional modules.

ANDROMEDA can download additional payloads from C2.

Shai-Hulud has downloaded packages from code repositories. Shai-Hulud has also downloaded and executed the secrets-discovery tool TruffleHog to gather sensitive data.

JPIN can download files and upgrade itself.

VIRTUALPITA has the ability to upload and download files.

metaMain can download files onto compromised systems.

SideTwist has the ability to download additional files.

KOCTOPUS has executed a PowerShell command to download a file to the system.

MechaFlounder has the ability to upload and download files to and from a compromised host.

Psylo has a command to download a file to the system from its C2 server.

HTTPBrowser is capable of writing a file to the compromised system from the C2 server.

Mis-Type has downloaded additional malware and files onto a compromised host.

XCSSET downloads browser specific AppleScript modules using a constructed URL with the curl command, https://" & domain & "/agent/scripts/" & moduleName & ".applescript.

Disco can download files to targeted systems via SMB.

Dipsind can download remote files.

Octopus can download additional files and tools onto the victim’s machine.

SoreFang can download additional payloads from C2.

Industroyer downloads a shellcode payload from a remote C2 server and loads it into memory.

Kevin can download files to the compromised host.

Agent Tesla can download additional files for execution on the victim’s machine.

Pasam creates a backdoor through which remote attackers can upload files.

POWERSTATS can retrieve and execute additional PowerShell payloads from the C2 server.

BADNEWS is capable of downloading additional files through C2 channels, including a new version of itself.

Linfo creates a backdoor through which remote attackers can download files onto compromised hosts.

ShadowPad has downloaded code from a C2 server.