Procedure examples

Astaroth uses certutil and BITSAdmin to download additional malware.

QakBot has the ability to download additional components and malware.

DOWNIISSA can download files to the compromised host.

CookieMiner can download additional scripts from a web server.

Hancitor has the ability to download additional files from C2.

Gelsemium can download additional plug-ins to a compromised host.

jRAT can download and execute files.

Helminth can download additional files.

BBK has the ability to download files from C2 to the infected host.

OSX/Shlayer can download payloads, and extract bytes from files. OSX/Shlayer uses the curl -fsL "$url" >$tmp_path command to download malicious payloads into a temporary directory.

Denis deploys additional backdoors and hacking tools to the system.

Waterbear can receive and load executables from remote C2 servers.

Vasport can download files.

JSS Loader has the ability to download malicious executables to a compromised host.

Lizar can download additional plugins, files, and tools.

Dtrack’s can download and upload a file to the victim’s computer.

H1N1 contains a command to download and execute a file from a remotely hosted URL using WinINet HTTP requests.

Seth-Locker has the ability to download and execute files on a compromised host.

LoudMiner used SCP to update the miner from the C2.

Azorult can download and execute additional files. Azorult has also downloaded a ransomware payload called Hermes.

Zox can download files to a compromised machine.

UPPERCUT can download and upload files to and from the victim’s machine.

StrifeWater can download updates and auxiliary modules.

Mivast has the capability to download and execute .exe files.

HiddenWasp downloads a tar compressed archive from a download server to the system.

WarzoneRAT can download and execute additional files.

SLOTHFULMEDIA has downloaded files onto a victim machine.

XORIndex Loader has been used to download a malicious payload to include BeaverTail.

Small Sieve has the ability to download files.

RemoteUtilities can upload and download files to and from a target machine.

certutil can be used to download files from a given URL.

ShimRatReporter had the ability to download additional payloads.

Sliver can download additional content and files from the Sliver server to the client residing on the victim machine using the upload command.

SILENTTRINITY can load additional files and tools, including Mimikatz.

Empire can upload and download to and from a victim machine.

CSPY Downloader can download additional tools to a compromised host.

CARROTBALL has the ability to download and install a remote payload.

BITSAdmin can be used to create BITS Jobs to upload and/or download files.

AsyncRAT has the ability to download files including over SFTP.

Brute Ratel C4 can download files to compromised hosts.

Remcos can upload and download files to and from the victim’s machine.

MCMD can upload additional files to a compromised host.

Donut can download and execute previously staged shellcode payloads.

cmd can be used to copy files to/from a remotely connected external system.

esentutl can be used to copy files from a given URL.

Koadic can download additional files and tools.

Pupy can upload and download to/from a victim machine.

ftp may be abused by adversaries to transfer tools or files from an external system into a compromised environment.

QuasarRAT can download files to the victim’s machine and execute them.

TeamPCP Cloud Stealer has the ability to download additional payloads to targeted systems.