Procedure examples

TrickBot downloads several additional files and saves them to the victim's machine.

PowerDuke has a command to download a file.

BLINDINGCAN has downloaded files to a victim machine.

Wiarp creates a backdoor through which remote attackers can download files.

RCSession has the ability to drop additional files to an infected machine.

QuietSieve can download and execute payloads on a target host.

Bumblebee can download and execute additional payloads including through the use of a `Dex` command.

BRICKSTORM has the ability to download files from the Adversaries C2 server to the compromised system.

Amadey can download and execute files to further infect a host machine with additional malware.

NICECURL has the ability to download additional content onto an infected machine, e.g. by using `curl`.

Orz can download files onto the victim.

NOKKI has downloaded a remote module for execution.

Backdoor.Oldrea can download additional modules from C2.

DOGCALL can download and execute additional payloads.

After downloading its main config file, Downdelph downloads multiple payloads from C2 servers.

SEASHARPEE can download remote files onto victims.

POWRUNER can download or upload files from its C2 server.

TDTESS has a command to download and execute an additional file.

SharpStage has the ability to download and execute additional payloads via a DropBox API.

Sardonic has the ability to upload additional malicious files to a compromised machine.

Smoke Loader downloads a new version of itself once it has installed. It also downloads additional plugins.

Misdat is capable of downloading files from the C2.

reGeorg has the ability to download files to targeted systems.

Emissary has the capability to download files from the C2 server.

Exaramel for Linux has a command to download a file from and to a remote C2 server.

KEYMARBLE can upload files to the victim’s machine and can download additional payloads.

TAMECAT has used `wget` and `curl` to download additional content.

CostaBricks can download additional payloads onto a compromised host.

Ursnif has dropped payload and configuration files to disk. Ursnif has also been used to download and execute additional payloads.

CASTLETAP can transfer files to compromised network devices.

ThreatNeedle can download additional tools to enable lateral movement.

ZLib has the ability to download files.

RedLeaves is capable of downloading a file from a specified URL.

POWERSOURCE has been observed being used to download TEXTMATE and the Cobalt Strike Beacon payload onto victims.

Tsundere Botnet’s loader component has downloaded the zip file node-v18.17.0-win-x64.zip from the official Node.js website, as well as pm2, a Node.js process management tool.

Felismus can download files from remote servers.

Zeus Panda can download additional malware plug-in modules and execute them on the victim’s machine.

Havoc has the ability to upload files to infected systems.

CARROTBAT has the ability to download and execute a remote file via certutil.

WEBC2 can download and execute a file.

InvisibleFerret has downloaded “AnyDesk.exe” into the user’s home directory from the C2 server when checks for the service fail to identify its presence in the victim environment. InvisibleFerret has also been configured to download additional payloads using a command which calls to the /bow URI.

Bankshot uploads files and secondary payloads to the victim's machine.

SharpDisco has been used to download a Python interpreter to `C:\Users\Public\WinTN\WinTN.exe` as well as other plugins from external sources.

StrongPity can download files to specified targets.

can download and execute a second-stage payload.

xCaon has a command to download files to the victim's machine.

PLAINTEE has downloaded and executed additional plugins.

Pony can download additional files onto the infected system.

Nebulae can download files from C2.

AuditCred can download files and additional malware.