Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Передача инструментов из внешней сети

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer). On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, certutil, and PowerShell commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`.(Citation: t1105_lolbas) Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by User Execution (typically after interacting with Phishing lures).(Citation: T1105: Trellix_search-ms) Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system.(Citation: PTSecurity Cobalt Dec 2016) In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.(Citation: Dropbox Malware Sync)

ID: T1105

Тактика(-и): Command and Control

Платформы: Linux, macOS, Network, Windows

Источники данных: Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow

Версия: 2.4

Дата создания: 31 May 2017

Последнее изменение: 11 Apr 2024

Название	Описание
Примеры процедур
Frankenstein	Frankenstein has uploaded and downloaded files to utilize additional plugins.(Citation: Talos Frankenstein June 2019)
Fox Kitten	Fox Kitten has downloaded additional tools including PsExec directly to endpoints.(Citation: CISA AA20-259A Iran-Based Actor September 2020)
EvilBunny	EvilBunny has downloaded additional Lua scripts from the C2.(Citation: Cyphort EvilBunny Dec 2014)
Pandora	Pandora can load additional drivers and files onto a victim machine.(Citation: Trend Micro Iron Tiger April 2021)
ShimRat	ShimRat can download additional files.(Citation: FOX-IT May 2016 Mofang)
BUSHWALK	BUSHWALK can write malicious payloads sent through a web request’s command parameter.(Citation: Mandiant Cutting Edge Part 2 January 2024)(Citation: Mandiant Cutting Edge Part 3 February 2024)
DarkTortilla	DarkTortilla can download additional packages for keylogging, cryptocurrency mining, and other capabilities; it can also retrieve malicious payloads such as Agent Tesla, AsyncRat, NanoCore, RedLine, Cobalt Strike, and Metasploit.(Citation: Secureworks DarkTortilla Aug 2022)
SodaMaster	SodaMaster has the ability to download additional payloads from C2 to the targeted system.(Citation: Securelist APT10 March 2021)
BITTER	BITTER has downloaded additional malware and tools onto a compromised host.(Citation: Cisco Talos Bitter Bangladesh May 2022)(Citation: Forcepoint BITTER Pakistan Oct 2016)
Shark	Shark can download additional files from its C2 via HTTP or DNS.(Citation: ClearSky Siamesekitten August 2021)(Citation: Accenture Lyceum Targets November 2021)
More_eggs	More_eggs can download and launch additional payloads.(Citation: Talos Cobalt Group July 2018)(Citation: Security Intelligence More Eggs Aug 2019)
SEASHARPEE	SEASHARPEE can download remote files onto victims.(Citation: FireEye APT34 Webinar Dec 2017)
WellMail	WellMail can receive data and executable scripts from C2.(Citation: CISA WellMail July 2020)
HAFNIUM	HAFNIUM has downloaded malware and tools--including Nishang and PowerCat--onto a compromised host.(Citation: Microsoft HAFNIUM March 2020)(Citation: Rapid7 HAFNIUM Mar 2021)
Cobalt Group	Cobalt Group has used public sites such as github.com and sendspace.com to upload files and then download them to victim computers.(Citation: PTSecurity Cobalt Group Aug 2017)(Citation: PTSecurity Cobalt Dec 2016) The group's JavaScript backdoor is also capable of downloading files.(Citation: Morphisec Cobalt Gang Oct 2018)
DDKONG	DDKONG downloads and uploads files on the victim’s machine.(Citation: Rancor Unit42 June 2018)
macOS.OSAMiner	macOS.OSAMiner has used `curl` to download a Stripped Payloads from a public facing adversary-controlled webpage.
SoreFang	SoreFang can download additional payloads from C2.(Citation: CISA SoreFang July 2016)(Citation: NCSC APT29 July 2020)
ANDROMEDA	ANDROMEDA can download additional payloads from C2.(Citation: Mandiant Suspected Turla Campaign February 2023)
ZxxZ	ZxxZ can download and execute additional files.(Citation: Cisco Talos Bitter Bangladesh May 2022)
Cinnamon Tempest	Cinnamon Tempest has downloaded files, including Cobalt Strike, to compromised hosts.(Citation: Sygnia Emperor Dragonfly October 2022)
Ursnif	Ursnif has dropped payload and configuration files to disk. Ursnif has also been used to download and execute additional payloads.(Citation: TrendMicro PE_URSNIF.A2)(Citation: TrendMicro BKDR_URSNIF.SM)
HTTPBrowser	HTTPBrowser is capable of writing a file to the compromised system from the C2 server.(Citation: Dell TG-3390)
Action RAT	Action RAT has the ability to download additional payloads onto an infected machine.(Citation: MalwareBytes SideCopy Dec 2021)
Vasport	Vasport can download files.(Citation: Symantec Vasport May 2012)
down_new	down_new has the ability to download files to the compromised host.(Citation: Trend Micro Tick November 2019)
Tropic Trooper	Tropic Trooper has used a delivered trojan to download additional files.(Citation: TrendMicro Tropic Trooper May 2020)
BendyBear	BendyBear is designed to download an implant from a C2 server.(Citation: Unit42 BendyBear Feb 2021)
Wiarp	Wiarp creates a backdoor through which remote attackers can download files.(Citation: Symantec Wiarp May 2012)
Nerex	Nerex creates a backdoor through which remote attackers can download files onto a compromised host.(Citation: Symantec Ristol May 2012)
PS1	CostaBricks can download additional payloads onto a compromised host.(Citation: BlackBerry CostaRicto November 2020)
NanoCore	NanoCore has the capability to download and activate additional modules for execution.(Citation: DigiTrust NanoCore Jan 2017)(Citation: PaloAlto NanoCore Feb 2016)
StoneDrill	StoneDrill has downloaded and dropped temporary files containing scripts; it additionally has a function to upload files from the victims machine.(Citation: Kaspersky StoneDrill 2017)
UNC2452	UNC2452 downloaded additional tools, such as TEARDROP malware and Cobalt Strike, to the compromised host following initial compromise.(Citation: FireEye SUNBURST Backdoor December 2020)
Lazarus Group	Lazarus Group has downloaded files, malware, and tools from its C2 onto a compromised host.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)(Citation: Novetta Blockbuster Loaders)(Citation: SentinelOne Lazarus macOS July 2020)(Citation: TrendMicro macOS Dacls May 2020)(Citation: Kaspersky ThreatNeedle Feb 2021)(Citation: Google TAG Lazarus Jan 2021)(Citation: Lazarus APT January 2022)(Citation: Qualys LolZarus)(Citation: ESET Twitter Ida Pro Nov 2021)
Anchor	Anchor can download additional payloads.(Citation: Cyberreason Anchor December 2019)(Citation: Medium Anchor DNS July 2020)
Denis	Denis deploys additional backdoors and hacking tools to the system.(Citation: Cybereason Cobalt Kitty 2017)
TURNEDUP	TURNEDUP is capable of downloading additional files.(Citation: FireEye APT33 Sept 2017)
PLATINUM	PLATINUM has transferred files using the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel.(Citation: Microsoft PLATINUM June 2017)
Disco	Disco can download files to targeted systems via SMB.(Citation: MoustachedBouncer ESET August 2023)
ShimRatReporter	ShimRatReporter had the ability to download additional payloads.(Citation: FOX-IT May 2016 Mofang)
Elise	Elise can download additional files from the C2 server for execution.(Citation: Accenture Dragonfish Jan 2018)
Okrum	Okrum has built-in commands for uploading, downloading, and executing files to the system.(Citation: ESET Okrum July 2019)
Pupy	Pupy can upload and download to/from a victim machine.(Citation: GitHub Pupy)
Ke3chang	Ke3chang has used tools to download files to compromised machines.(Citation: Microsoft NICKEL December 2021)
Nebulae	Nebulae can download files from C2.(Citation: Bitdefender Naikon April 2021)
Exaramel for Linux	Exaramel for Linux has a command to download a file from and to a remote C2 server.(Citation: ESET TeleBots Oct 2018)(Citation: ANSSI Sandworm January 2021)
QuietSieve	QuietSieve can download and execute payloads on a target host.(Citation: Microsoft Actinium February 2022)
Sharpshooter	Sharpshooter downloaded additional payloads after a target was infected with a first-stage downloader.(Citation: McAfee Sharpshooter December 2018)
njRAT	njRAT can download files to the victim’s machine.(Citation: Fidelis njRAT June 2013)(Citation: Trend Micro njRAT 2018)
	During CostaRicto, the threat actors downloaded malware and tools onto a compromised host.(Citation: BlackBerry CostaRicto November 2020)
Seth-Locker	Seth-Locker has the ability to download and execute files on a compromised host.(Citation: Trend Micro Ransomware February 2021)
YAHOYAH	YAHOYAH uses HTTP GET requests to download other files that are executed in memory.(Citation: TrendMicro TropicTrooper 2015)
Hi-Zor	Hi-Zor has the ability to upload and download files from its C2 server.(Citation: Fidelis INOCNATION)
Whitefly	Whitefly has the ability to download additional tools from the C2.(Citation: Symantec Whitefly March 2019)
BabyShark	BabyShark has downloaded additional files from the C2.(Citation: Unit42 BabyShark Apr 2019)(Citation: CISA AA20-301A Kimsuky)
APT37	APT37 has downloaded second stage malware from compromised websites.(Citation: FireEye APT37 Feb 2018)(Citation: Securelist ScarCruft May 2019)(Citation: Volexity InkySquid BLUELIGHT August 2021)(Citation: Volexity InkySquid RokRAT August 2021)
BackConfig	BackConfig can download and execute additional payloads on a compromised host.(Citation: Unit 42 BackConfig May 2020)
SILENTTRINITY	SILENTTRINITY can load additional files and tools, including Mimikatz.(Citation: GitHub SILENTTRINITY Modules July 2019)
Bisonal	Bisonal has the capability to download files to execute on the victim’s machine.(Citation: Unit 42 Bisonal July 2018)(Citation: Kaspersky CactusPete Aug 2020)(Citation: Talos Bisonal Mar 2020)
BLINDINGCAN	BLINDINGCAN has downloaded files to a victim machine.(Citation: US-CERT BLINDINGCAN Aug 2020)
SpeakUp	SpeakUp downloads and executes additional files from a remote server. (Citation: CheckPoint SpeakUp Feb 2019)
SQLRat	SQLRat can make a direct SQL connection to a Microsoft database controlled by the attackers, retrieve an item from the bindata table, then write and execute the file on disk.(Citation: Flashpoint FIN 7 March 2019)
SideCopy	SideCopy has delivered trojanized executables via spearphishing emails that contacts actor-controlled servers to download malicious payloads.(Citation: MalwareBytes SideCopy Dec 2021)
TSCookie	TSCookie has the ability to upload and download files to and from the infected host.(Citation: JPCert TSCookie March 2018)
Skidmap	Skidmap has the ability to download files on an infected host.(Citation: Trend Micro Skidmap)
Revenge RAT	Revenge RAT has the ability to upload and download files.(Citation: Cylance Shaheen Nov 2018)
TA2541	TA2541 has used malicious scripts and macros with the ability to download additional payloads.(Citation: Cisco Operation Layover September 2021)
Kimsuky	Kimsuky has downloaded additional scripts, tools, and malware onto victim systems.(Citation: Crowdstrike GTR2020 Mar 2020)(Citation: Talos Kimsuky Nov 2021)
Meteor	Meteor has the ability to download additional files for execution on the victim's machine.(Citation: Check Point Meteor Aug 2021)
ZLib	ZLib has the ability to download files.(Citation: Cylance Dust Storm)
Turla	Turla has used shellcode to download Meterpreter after compromising a victim.(Citation: ESET Turla Mosquito May 2018)
Grandoreiro	Grandoreiro can download its second stage from a hardcoded URL within the loader's code.(Citation: IBM Grandoreiro April 2020)(Citation: ESET Grandoreiro April 2020)
BLUELIGHT	BLUELIGHT can download additional files onto the host.(Citation: Volexity InkySquid BLUELIGHT August 2021)
RogueRobin	RogueRobin can save a new file to the system from the C2 server.(Citation: Unit 42 DarkHydrus July 2018)(Citation: Unit42 DarkHydrus Jan 2019)
Kazuar	Kazuar downloads additional plug-ins to load on the victim’s machine, including the ability to upgrade and replace its own binary.(Citation: Unit 42 Kazuar May 2017)
Neoichor	Neoichor can download additional files onto a compromised host.(Citation: Microsoft NICKEL December 2021)
BoxCaon	BoxCaon can download files.(Citation: Checkpoint IndigoZebra July 2021)
CHIMNEYSWEEP	CHIMNEYSWEEP can download additional files from C2.(Citation: Mandiant ROADSWEEP August 2022)
Daserf	Daserf can download remote files.(Citation: Trend Micro Daserf Nov 2017)(Citation: Secureworks BRONZE BUTLER Oct 2017)
Zebrocy	Zebrocy obtains additional code to execute on the victim's machine, including the downloading of a secondary payload.(Citation: Palo Alto Sofacy 06-2018)(Citation: Unit42 Cannon Nov 2018)(Citation: ESET Zebrocy May 2019)(Citation: Accenture SNAKEMACKEREL Nov 2018)
Gamaredon Group	Gamaredon Group has downloaded additional malware and tools onto a compromised host.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: Microsoft Actinium February 2022) For example, Gamaredon Group uses a backdoor script to retrieve and decode additional payloads once in victim environments.(Citation: unit42_gamaredon_dec2022)
LOWBALL	LOWBALL uses the Dropbox API to request two files, one of which is the same file as the one dropped by the malicious email attachment. This is most likely meant to be a mechanism to update the compromised host with a new version of the LOWBALL malware.(Citation: FireEye admin@338)
Kessel	Kessel can download additional modules from the C2 server.(Citation: ESET ForSSHe December 2018)
Leviathan	Leviathan has downloaded additional scripts and files from adversary-controlled servers.(Citation: Proofpoint Leviathan Oct 2017)(Citation: FireEye Periscope March 2018)
	During Operation Dream Job, Lazarus Group downloaded multistage malware and tools onto a compromised host.(Citation: ClearSky Lazarus Aug 2020)(Citation: ESET Lazarus Jun 2020)(Citation: McAfee Lazarus Jul 2020)
PolyglotDuke	PolyglotDuke can retrieve payloads from the C2 server.(Citation: ESET Dukes October 2019)
Dipsind	Dipsind can download remote files.(Citation: Microsoft PLATINUM April 2016)
Peppy	Peppy can download and execute remote files.(Citation: Proofpoint Operation Transparent Tribe March 2016)
cmd	cmd can be used to copy files to/from a remotely connected external system.(Citation: TechNet Copy)
menuPass	menuPass has installed updates and new malware on victims.(Citation: PWC Cloud Hopper April 2017)(Citation: District Court of NY APT10 Indictment December 2018)
RainyDay	RainyDay can download files to a compromised host.(Citation: Bitdefender Naikon April 2021)
Cardinal RAT	Cardinal RAT can download and execute additional payloads.(Citation: PaloAlto CardinalRat Apr 2017)
WarzoneRAT	WarzoneRAT can download and execute additional files.(Citation: Check Point Warzone Feb 2020)
MarkiRAT	MarkiRAT can download additional files and tools from its C2 server, including through the use of BITSAdmin.(Citation: Kaspersky Ferocious Kitten Jun 2021)
	During C0027, Scattered Spider downloaded tools using victim organization systems.(Citation: Crowdstrike TELCO BPO Campaign December 2022)
KARAE	KARAE can upload and download files, including second-stage malware.(Citation: FireEye APT37 Feb 2018)
Molerats	Molerats used executables to download malicious files from different sources.(Citation: Kaspersky MoleRATs April 2019)(Citation: Unit42 Molerat Mar 2020)
Small Sieve	Small Sieve has the ability to download files.(Citation: NCSC GCHQ Small Sieve Jan 2022)
China Chopper	China Chopper's server component can download remote files.(Citation: FireEye Periscope March 2018)(Citation: Lee 2013)(Citation: NCSC Joint Report Public Tools)(Citation: Rapid7 HAFNIUM Mar 2021)(Citation: Kaspersky ToddyCat June 2022)
XCSSET	XCSSET downloads browser specific AppleScript modules using a constructed URL with the `curl` command, `https://" & domain & "/agent/scripts/" & moduleName & ".applescript`.(Citation: trendmicro xcsset xcode project 2020)
KEYMARBLE	KEYMARBLE can upload files to the victim’s machine and can download additional payloads.(Citation: US-CERT KEYMARBLE Aug 2018)
Carberp	Carberp can download and execute new plugins from the C2 server. (Citation: Prevx Carberp March 2011)(Citation: Trusteer Carberp October 2010)
Unknown Logger	Unknown Logger is capable of downloading remote files.(Citation: Forcepoint Monsoon)
Lucifer	Lucifer can download and execute a replica of itself using certutil.(Citation: Unit 42 Lucifer June 2020)
Sakula	Sakula has the capability to download files.(Citation: Dell Sakula)
PoetRAT	PoetRAT has the ability to copy files and download/upload files into C2 channels using FTP and HTTPS.(Citation: Talos PoetRAT April 2020)(Citation: Talos PoetRAT October 2020)
gh0st RAT	gh0st RAT can download files to the victim’s machine.(Citation: Nccgroup Gh0st April 2018)(Citation: Gh0stRAT ATT March 2019)
BoomBox	BoomBox has the ability to download next stage malware components to a compromised system.(Citation: MSTIC Nobelium Toolset May 2021)
RegDuke	RegDuke can download files from C2.(Citation: ESET Dukes October 2019)
NDiskMonitor	NDiskMonitor can download and execute a file from given URL.(Citation: TrendMicro Patchwork Dec 2017)
LitePower	LitePower has the ability to download payloads containing system commands to a compromised host.(Citation: Kaspersky WIRTE November 2021)
Pteranodon	Pteranodon can download and execute additional files.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: Symantec Shuckworm January 2022)(Citation: Unit 42 Gamaredon February 2022)
Briba	Briba downloads files onto infected hosts.(Citation: Symantec Briba May 2012)
Dacls	Dacls can download its payload from a C2 server.(Citation: SentinelOne Lazarus macOS July 2020)(Citation: TrendMicro macOS Dacls May 2020)
Saint Bot	Saint Bot can download additional files onto a compromised host.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
FYAnti	FYAnti can download additional payloads to a compromised host.(Citation: Securelist APT10 March 2021)
WIREFIRE	WIREFIRE has the ability to download files to compromised devices.(Citation: Mandiant Cutting Edge January 2024)
APT29	APT29 has downloaded additional tools and malware onto compromised networks.(Citation: Mandiant No Easy Breach)(Citation: PWC WellMess July 2020)(Citation: F-Secure The Dukes)(Citation: Mandiant APT29 Eye Spy Email Nov 22)
Hancitor	Hancitor has the ability to download additional files from C2.(Citation: Threatpost Hancitor)
Shamoon	Shamoon can download an executable to run on the victim.(Citation: Palo Alto Shamoon Nov 2016)
Rocke	Rocke used malware to download additional malicious files to the target system.(Citation: Talos Rocke August 2018)
PipeMon	PipeMon can install additional modules via C2 commands.(Citation: ESET PipeMon May 2020)
Pony	Pony can download additional files onto the infected system.(Citation: Malwarebytes Pony April 2016)
SVCReady	SVCReady has the ability to download additional tools such as the RedLine Stealer to an infected host.(Citation: HP SVCReady Jun 2022)
Kevin	Kevin can download files to the compromised host.(Citation: Kaspersky Lyceum October 2021)
Sidewinder	Sidewinder has used LNK files to download remote files to the victim's network.(Citation: ATT Sidewinder January 2021)(Citation: Cyble Sidewinder September 2020)
Calisto	Calisto has the capability to upload and download files to the victim's machine.(Citation: Symantec Calisto July 2018)
Agent Tesla	Agent Tesla can download additional files for execution on the victim’s machine.(Citation: Talos Agent Tesla Oct 2018)(Citation: DigiTrust Agent Tesla Jan 2017)
Koadic	Koadic can download additional files and tools.(Citation: Github Koadic)(Citation: MalwareBytes LazyScripter Feb 2021)
Mis-Type	Mis-Type has downloaded additional malware and files onto a compromised host.(Citation: Cylance Dust Storm)
Chrommme	Chrommme can download its code from C2.(Citation: ESET Gelsemium June 2021)
TYPEFRAME	TYPEFRAME can upload and download files to the victim’s machine.(Citation: US-CERT TYPEFRAME June 2018)
ServHelper	ServHelper may download additional files to execute.(Citation: Proofpoint TA505 Jan 2019)(Citation: Deep Instinct TA505 Apr 2019)
Nidiran	Nidiran can download and execute files.(Citation: Symantec Backdoor.Nidiran)
SocGholish	SocGholish can download additional malware to infected hosts.(Citation: Red Canary SocGholish March 2024)(Citation: Secureworks Gold Prelude Profile)
SMOKEDHAM	SMOKEDHAM has used Powershell to download UltraVNC and ngrok from third-party file sharing sites.(Citation: FireEye SMOKEDHAM June 2021)
Gold Dragon	Gold Dragon can download additional components from the C2 server.(Citation: McAfee Gold Dragon)
Bandook	Bandook can download files to the system.(Citation: CheckPoint Bandook Nov 2020)
Dyre	Dyre has a command to download and executes additional files.(Citation: Symantec Dyre June 2015)
Magic Hound	Magic Hound has downloaded additional code and files from servers onto victims.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)(Citation: Microsoft Iranian Threat Actor Trends November 2021)
	APT41 DUST involved execution of `certutil.exe` via web shell to download the DUSTPAN dropper.(Citation: Google Cloud APT41 2024)
NanHaiShu	NanHaiShu can download additional files from URLs.(Citation: Proofpoint Leviathan Oct 2017)
CostaBricks	CostaBricks has been used to load SombRAT onto a compromised host.(Citation: BlackBerry CostaRicto November 2020)
Operation Wocao	Operation Wocao can download additional files to the infected system.(Citation: FoxIT Wocao December 2019)
GrimAgent	GrimAgent has the ability to download and execute additional payloads.(Citation: Group IB GrimAgent July 2021)
Sardonic	Sardonic has the ability to upload additional malicious files to a compromised machine.(Citation: Bitdefender Sardonic Aug 2021)
QuasarRAT	QuasarRAT can download files to the victim’s machine and execute them.(Citation: GitHub QuasarRAT)(Citation: Volexity Patchwork June 2018)
S-Type	S-Type can download additional files onto a compromised host.(Citation: Cylance Dust Storm)
Smoke Loader	Smoke Loader downloads a new version of itself once it has installed. It also downloads additional plugins.(Citation: Malwarebytes SmokeLoader 2016)
PowerLess	PowerLess can download additional payloads to a compromised host.(Citation: Cybereason PowerLess February 2022)
RARSTONE	RARSTONE downloads its backdoor component from a C2 server and loads it directly into memory.(Citation: Aquino RARSTONE)
Zeus Panda	Zeus Panda can download additional malware plug-in modules and execute them on the victim’s machine.(Citation: GDATA Zeus Panda June 2017)
	During Frankenstein, the threat actors downloaded files and tools onto a victim machine.(Citation: Talos Frankenstein June 2019)
SLOWDRIFT	SLOWDRIFT downloads additional payloads.(Citation: FireEye APT37 Feb 2018)
AuditCred	AuditCred can download files and additional malware.(Citation: TrendMicro Lazarus Nov 2018)
Milan	Milan has received files from C2 and stored them in log folders beginning with the character sequence `a9850d2f`.(Citation: ClearSky Siamesekitten August 2021)
ThreatNeedle	ThreatNeedle can download additional tools to enable lateral movement.(Citation: Kaspersky ThreatNeedle Feb 2021)
Industroyer	Industroyer downloads a shellcode payload from a remote C2 server and loads it into memory.(Citation: ESET Industroyer)
Aquatic Panda	Aquatic Panda has downloaded additional malware onto compromised hosts.(Citation: CrowdStrike AQUATIC PANDA December 2021)
Raspberry Robin	Raspberry Robin retrieves its second stage payload in a variety of ways such as through msiexec.exe abuse, or running the curl command to download the payload to the victim's `%AppData%` folder.(Citation: HP RaspberryRobin 2024)(Citation: RedCanary RaspberryRobin 2022)
	Water Curupira Pikabot Distribution used Curl.exe to download the Pikabot payload from an external server, saving the file to the victim machine's temporary directory.(Citation: TrendMicro Pikabot 2024)
APT38	APT38 used a backdoor, NESTEGG, that has the capability to download and upload files to and from a victim’s machine.(Citation: FireEye APT38 Oct 2018)
Zox	Zox can download files to a compromised machine.(Citation: Novetta-Axiom)
Dragonfly 2.0	Dragonfly 2.0 copied and installed tools for operations once in the victim environment.(Citation: US-CERT TA18-074A)(Citation: US-CERT APT Energy Oct 2017)
MobileOrder	MobileOrder has a command to download a file from the C2 server to the victim mobile device's SD card.(Citation: Scarlet Mimic Jan 2016)
BBK	BBK has the ability to download files from C2 to the infected host.(Citation: Trend Micro Tick November 2019)
Attor	Attor can download additional plugins, updates and other files. (Citation: ESET Attor Oct 2019)
Melcoz	Melcoz has the ability to download additional files to a compromised host.(Citation: Securelist Brazilian Banking Malware July 2020)
Spica	Spica can upload and download files to and from compromised hosts.(Citation: Google TAG COLDRIVER January 2024)
LuminousMoth	LuminousMoth has downloaded additional malware and tools onto a compromised host.(Citation: Kaspersky LuminousMoth July 2021)(Citation: Bitdefender LuminousMoth July 2021)
SeaDuke	SeaDuke is capable of uploading and downloading files.(Citation: Unit 42 SeaDuke 2015)
NavRAT	NavRAT can download files remotely.(Citation: Talos NavRAT May 2018)
Linfo	Linfo creates a backdoor through which remote attackers can download files onto compromised hosts.(Citation: Symantec Linfo May 2012)
Waterbear	Waterbear can receive and load executables from remote C2 servers.(Citation: Trend Micro Waterbear December 2019)
OSX_OCEANLOTUS.D	OSX_OCEANLOTUS.D has a command to download and execute a file on the victim’s machine.(Citation: TrendMicro MacOS April 2018)(Citation: Trend Micro MacOS Backdoor November 2020)
Hydraq	Hydraq creates a backdoor through which remote attackers can download files and additional malware components.(Citation: Symantec Trojan.Hydraq Jan 2010)(Citation: Symantec Hydraq Jan 2010)
SLIGHTPULSE	RAPIDPULSE can transfer files to and from compromised hosts.(Citation: Mandiant Pulse Secure Update May 2021)
SombRAT	SombRAT has the ability to download and execute additional payloads.(Citation: BlackBerry CostaRicto November 2020)(Citation: FireEye FiveHands April 2021)(Citation: CISA AR21-126A FIVEHANDS May 2021)
Gorgon Group	Gorgon Group malware can download additional files from C2 servers.(Citation: Unit 42 Gorgon Group Aug 2018)
DnsSystem	DnsSystem can download files to compromised systems after receiving a command with the string `downloaddd`.(Citation: Zscaler Lyceum DnsSystem June 2022)
APT39	APT39 has downloaded tools to compromised hosts.(Citation: Symantec Chafer February 2018)(Citation: FBI FLASH APT39 September 2020)
WellMess	WellMess can write files to a compromised host.(Citation: PWC WellMess July 2020)(Citation: CISA WellMess July 2020)
CSPY Downloader	CSPY Downloader can download additional tools to a compromised host.(Citation: Cybereason Kimsuky November 2020)
Samurai	Samurai has been used to deploy other malware including Ninja.(Citation: Kaspersky ToddyCat June 2022)
Cuba	Cuba can download files from its C2 server.(Citation: McAfee Cuba April 2021)
KOCTOPUS	KOCTOPUS has executed a PowerShell command to download a file to the system.(Citation: MalwareBytes LazyScripter Feb 2021)
APT28	APT28 has downloaded additional files, including by using a first-stage downloader to contact the C2 server to obtain the second-stage implant.(Citation: Bitdefender APT28 Dec 2015)(Citation: Unit 42 Playbook Dec 2017)(Citation: Accenture SNAKEMACKEREL Nov 2018)(Citation: TrendMicro Pawn Storm Dec 2020)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)
NOKKI	NOKKI has downloaded a remote module for execution.(Citation: Unit 42 NOKKI Sept 2018)
Taidoor	Taidoor has downloaded additional files onto a compromised host.(Citation: TrendMicro Taidoor)
Squirrelwaffle	Squirrelwaffle has downloaded and executed additional encoded payloads.(Citation: ZScaler Squirrelwaffle Sep 2021)(Citation: Netskope Squirrelwaffle Oct 2021)
DRATzarus	DRATzarus can deploy additional tools onto an infected machine.(Citation: ClearSky Lazarus Aug 2020)
RCSession	RCSession has the ability to drop additional files to an infected machine.(Citation: Profero APT27 December 2020)
MiniDuke	MiniDuke can download additional encrypted backdoors onto the victim via GIF files.(Citation: Securelist MiniDuke Feb 2013)(Citation: ESET Dukes October 2019)
Raccoon Stealer	Raccoon Stealer downloads various library files enabling interaction with various data stores and structures to facilitate follow-on information theft.(Citation: S2W Racoon 2022)(Citation: Sekoia Raccoon2 2022)
	During C0015, the threat actors downloaded additional tools and files onto a compromised network.(Citation: DFIR Conti Bazar Nov 2021)
Threat Group-3390	Threat Group-3390 has downloaded additional malware and tools, including through the use of `certutil`, onto a compromised host .(Citation: Dell TG-3390)(Citation: Trend Micro DRBControl February 2020)
Doki	Doki has downloaded scripts from C2.(Citation: Intezer Doki July 20)
SideTwist	SideTwist has the ability to download additional files.(Citation: Check Point APT34 April 2021)
Bundlore	Bundlore can download and execute new versions of itself.(Citation: MacKeeper Bundlore Apr 2019)
DanBot	DanBot can download additional files to a targeted system.(Citation: SecureWorks August 2019)
Mosquito	Mosquito can upload and download files to the victim.(Citation: ESET Turla Mosquito Jan 2018)
CARROTBALL	CARROTBALL has the ability to download and install a remote payload.(Citation: Unit 42 CARROTBAT January 2020)
Azorult	Azorult can download and execute additional files. Azorult has also downloaded a ransomware payload called Hermes.(Citation: Unit42 Azorult Nov 2018)(Citation: Proofpoint Azorult July 2018)
	KV Botnet Activity included the use of scripts to download additional payloads when compromising network nodes.(Citation: Lumen KVBotnet 2023)
Bumblebee	Bumblebee can download and execute additional payloads including through the use of a `Dex` command.(Citation: Google EXOTIC LILY March 2022)(Citation: Proofpoint Bumblebee April 2022)(Citation: Symantec Bumblebee June 2022)
Latrodectus	Latrodectus can download and execute PEs, DLLs, and shellcode from C2.(Citation: Latrodectus APR 2024)(Citation: Elastic Latrodectus May 2024)(Citation: Bitsight Latrodectus June 2024)
Volgmer	Volgmer can download remote files and additional payloads to the victim's machine.(Citation: US-CERT Volgmer Nov 2017)(Citation: US-CERT Volgmer 2 Nov 2017)(Citation: Symantec Volgmer Aug 2014)
Trojan.Karagany	Trojan.Karagany can upload, download, and execute files on the victim.(Citation: Symantec Dragonfly)(Citation: Secureworks Karagany July 2019)
Penquin	Penquin can execute the command code `do_download` to retrieve remote files from C2.(Citation: Leonardo Turla Penquin May 2020)
HAPPYWORK	can download and execute a second-stage payload.(Citation: FireEye APT37 Feb 2018)
SharpStage	SharpStage has the ability to download and execute additional payloads via a DropBox API.(Citation: Cybereason Molerats Dec 2020)(Citation: BleepingComputer Molerats Dec 2020)
TinyTurla	TinyTurla has the ability to act as a second-stage dropper used to infect the system with additional malware.(Citation: Talos TinyTurla September 2021)
jRAT	jRAT can download and execute files.(Citation: jRAT Symantec Aug 2018)(Citation: Kaspersky Adwind Feb 2016)(Citation: Symantec Frutas Feb 2013)
CHOPSTICK	CHOPSTICK is capable of performing remote file transmission.(Citation: Crowdstrike DNC June 2016)
Orz	Orz can download files onto the victim.(Citation: Proofpoint Leviathan Oct 2017)
certutil	certutil can be used to download files from a given URL.(Citation: TechNet Certutil)(Citation: LOLBAS Certutil)
Rancor	Rancor has downloaded additional malware, including by using certutil.(Citation: Rancor Unit42 June 2018)
JPIN	JPIN can download files and upgrade itself.(Citation: Microsoft PLATINUM April 2016)
SysUpdate	SysUpdate has the ability to download files to a compromised host.(Citation: Trend Micro Iron Tiger April 2021)(Citation: Lunghi Iron Tiger Linux)
Seasalt	Seasalt has a command to download additional files.(Citation: Mandiant APT1 Appendix)(Citation: Mandiant APT1 Appendix)
DarkComet	DarkComet can load any files onto the infected machine to execute.(Citation: TrendMicro DarkComet Sept 2014)(Citation: Malwarebytes DarkComet March 2018)
FIN13	FIN13 has downloaded additional tools and malware to compromised systems.(Citation: Mandiant FIN13 Aug 2022)(Citation: Sygnia Elephant Beetle Jan 2022)
BADHATCH	BADHATCH has the ability to load a second stage malicious DLL file onto a compromised machine.(Citation: Gigamon BADHATCH Jul 2019)
Ixeshe	Ixeshe can download and execute additional files.(Citation: Trend Micro IXESHE 2012)
DUSTTRAP	DUSTTRAP can retrieve and load additional payloads.(Citation: Google Cloud APT41 2024)
DEATHRANSOM	DEATHRANSOM can download files to a compromised host.(Citation: FireEye FiveHands April 2021)
PlugX	PlugX has a module to download and execute files on the compromised machine.(Citation: CIRCL PlugX March 2013)(Citation: Proofpoint TA416 Europe March 2022)
	During the 2015 Ukraine Electric Power Attack, Sandworm Team pushed additional malicious tools onto an infected system to steal user credentials, move laterally, and destroy data. (Citation: Booz Allen Hamilton)
Micropsia	Micropsia can download and execute an executable from the C2 server.(Citation: Talos Micropsia June 2017)(Citation: Radware Micropsia July 2018)
SDBbot	SDBbot has the ability to download a DLL from C2 to a compromised host.(Citation: Proofpoint TA505 October 2019)
CookieMiner	CookieMiner can download additional scripts from a web server.(Citation: Unit42 CookieMiner Jan 2019)
SpicyOmelette	SpicyOmelette can download malicious files from threat actor controlled AWS URL's.(Citation: Secureworks GOLD KINGSWOOD September 2018)
CloudDuke	CloudDuke downloads and executes additional malware from either a Web address or a Microsoft OneDrive account.(Citation: F-Secure The Dukes)
Pasam	Pasam creates a backdoor through which remote attackers can upload files.(Citation: Symantec Pasam May 2012)
Xbash	Xbash can download additional malicious files from its C2 server.(Citation: Unit42 Xbash Sept 2018)
LightNeuron	LightNeuron has the ability to download and execute additional files.(Citation: ESET LightNeuron May 2019)
Remsec	Remsec contains a network loader to receive executable modules from remote attackers and run them on the local victim. It can also upload and download files over HTTP and HTTPS.(Citation: Symantec Remsec IOCs)(Citation: Kaspersky ProjectSauron Technical Analysis)
Flagpro	Flagpro can download additional malware from the C2 server.(Citation: NTT Security Flagpro new December 2021)
MuddyWater	MuddyWater has used malware that can upload additional files to the victim’s machine.(Citation: Securelist MuddyWater Oct 2018)(Citation: ClearSky MuddyWater Nov 2018)(Citation: Reaqta MuddyWater November 2017)(Citation: Trend Micro Muddy Water March 2021)
Emissary	Emissary has the capability to download files from the C2 server.(Citation: Lotus Blossom Dec 2015)
DropBook	DropBook can download and execute additional files.(Citation: Cybereason Molerats Dec 2020)(Citation: BleepingComputer Molerats Dec 2020)
Helminth	Helminth can download additional files.(Citation: Palo Alto OilRig May 2016)
Valak	Valak has downloaded a variety of modules and payloads to the compromised host, including IcedID and NetSupport Manager RAT-based malware.(Citation: Unit 42 Valak July 2020)(Citation: Cybereason Valak May 2020)
Egregor	Egregor has the ability to download files from its C2 server.(Citation: Cybereason Egregor Nov 2020)(Citation: Intrinsec Egregor Nov 2020)
KONNI	KONNI can download files and execute them on the victim’s machine.(Citation: Talos Konni May 2017)(Citation: Malwarebytes Konni Aug 2021)
PowerPunch	PowerPunch can download payloads from adversary infrastructure.(Citation: Microsoft Actinium February 2022)
APT18	APT18 can upload a file to the victim’s machine.(Citation: PaloAlto DNS Requests May 2016)
KeyBoy	KeyBoy has a download and upload functionality.(Citation: PWC KeyBoys Feb 2017)(Citation: Rapid7 KeyBoy Jun 2013)
Woody RAT	Woody RAT can download files from its C2 server, including the .NET DLLs, `WoodySharpExecutor` and `WoodyPowerSession`.(Citation: MalwareBytes WoodyRAT Aug 2022)
DarkGate	DarkGate retrieves cryptocurrency mining payloads and commands in encrypted traffic from its command and control server.(Citation: Ensilo Darkgate 2018) DarkGate uses Windows Batch scripts executing the `curl` command to retrieve follow-on payloads.(Citation: Trellix Darkgate 2023)
VaporRage	VaporRage has the ability to download malicious shellcode to compromised systems.(Citation: MSTIC Nobelium Toolset May 2021)
TeamTNT	TeamTNT has the `curl` and `wget` commands as well as batch scripts to download new tools.(Citation: Intezer TeamTNT September 2020)(Citation: Cisco Talos Intelligence Group)
	During Cutting Edge, threat actors leveraged exploits to download remote files to Ivanti Connect Secure VPNs.(Citation: Volexity Ivanti Zero-Day Exploitation January 2024)
Gazer	Gazer can execute a task to download a file.(Citation: ESET Gazer Aug 2017)(Citation: Securelist WhiteBear Aug 2017)
PUNCHBUGGY	PUNCHBUGGY can download additional files and payloads to compromised hosts.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)(Citation: Morphisec ShellTea June 2019)
OilRig	OilRig can download remote files onto victims.(Citation: FireEye APT34 Dec 2017)
PowerDuke	PowerDuke has a command to download a file.(Citation: Volexity PowerDuke November 2016)
SHARPSTATS	SHARPSTATS has the ability to upload and download files.(Citation: TrendMicro POWERSTATS V3 June 2019)
DOGCALL	DOGCALL can download and execute additional payloads.(Citation: Unit 42 Nokki Oct 2018)
LoudMiner	LoudMiner used SCP to update the miner from the C2.(Citation: ESET LoudMiner June 2019)
KGH_SPY	KGH_SPY has the ability to download and execute code from remote servers.(Citation: Cybereason Kimsuky November 2020)
Sibot	Sibot can download and execute a payload onto a compromised system.(Citation: MSTIC NOBELIUM Mar 2021)
PLEAD	PLEAD has the ability to upload and download files to and from an infected host.(Citation: JPCert PLEAD Downloader June 2018)
Winnti for Linux	Winnti for Linux has the ability to deploy modules directly from command and control (C2) servers, possibly for remote command execution, file exfiltration, and socks5 proxying on the infected host. (Citation: Chronicle Winnti for Linux May 2019)
Daggerfly	Daggerfly has used PowerShell and BITSAdmin to retrieve follow-on payloads from external locations for execution on victim machines.(Citation: Symantec Daggerfly 2023)
Play	Play has used Cobalt Strike to download files to compromised machines.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
BadPatch	BadPatch can download and execute or update malware.(Citation: Unit 42 BadPatch Oct 2017)
ROKRAT	ROKRAT can retrieve additional malicious payloads from its C2 server.(Citation: Talos ROKRAT)(Citation: NCCGroup RokRat Nov 2018)(Citation: Volexity InkySquid RokRAT August 2021)(Citation: Malwarebytes RokRAT VBA January 2021)
LazyScripter	LazyScripter had downloaded additional tools to a compromised host.(Citation: MalwareBytes LazyScripter Feb 2021)
ChChes	ChChes is capable of downloading files, including additional modules.(Citation: Palo Alto menuPass Feb 2017)(Citation: JPCERT ChChes Feb 2017)(Citation: FireEye APT10 April 2017)
Kivars	Kivars has the ability to download and execute files.(Citation: TrendMicro BlackTech June 2017)
APT32	APT32 has added JavaScript to victim websites to download additional frameworks that profile and compromise website visitors.(Citation: Volexity OceanLotus Nov 2017)
Silence	Silence has downloaded additional modules and malware to victim’s machines.(Citation: Group IB Silence Sept 2018)
Sliver	Sliver can upload files from the C2 server to the victim machine using the `upload` command.(Citation: GitHub Sliver Upload)
Gelsemium	Gelsemium can download additional plug-ins to a compromised host.(Citation: ESET Gelsemium June 2021)
Confucius	Confucius has downloaded additional files and payloads onto a compromised host following initial access.(Citation: Uptycs Confucius APT Jan 2021)(Citation: TrendMicro Confucius APT Aug 2021)
	During C0021, the threat actors downloaded additional tools and files onto victim machines.(Citation: Microsoft Unidentified Dec 2018)(Citation: FireEye APT29 Nov 2018)
HotCroissant	HotCroissant has the ability to upload a file from the command and control (C2) server to the victim machine.(Citation: Carbon Black HotCroissant April 2020)
P8RAT	P8RAT can download additional payloads to a target system.(Citation: Securelist APT10 March 2021)
Avenger	Avenger has the ability to download files from C2 to a compromised host.(Citation: Trend Micro Tick November 2019)
	During FunnyDream, the threat actors downloaded additional droppers and backdoors onto a compromised system.(Citation: Bitdefender FunnyDream Campaign November 2020)
OopsIE	OopsIE can download files from its C2 server to the victim's machine.(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 OilRig Sept 2018)
Backdoor.Oldrea	Backdoor.Oldrea can download additional modules from C2.(Citation: Gigamon Berserk Bear October 2021)
TAINTEDSCRIBE	TAINTEDSCRIBE can download additional modules from its C2 server.(Citation: CISA MAR-10288834-2.v1 TAINTEDSCRIBE MAY 2020)
Machete	Machete can download additional files for execution on the victim’s machine.(Citation: ESET Machete July 2019)
Snip3	Snip3 can download additional payloads to compromised systems.(Citation: Morphisec Snip3 May 2021)(Citation: Telefonica Snip3 December 2021)
Mafalda	Mafalda can download additional files onto the compromised host.(Citation: SentinelLabs Metador Technical Appendix Sept 2022)
FoggyWeb	FoggyWeb can receive additional malicious components from an actor controlled C2 server and execute them on a compromised AD FS server.(Citation: MSTIC FoggyWeb September 2021)
SLOTHFULMEDIA	SLOTHFULMEDIA has downloaded files onto a victim machine.(Citation: CISA MAR SLOTHFULMEDIA October 2020)
CoinTicker	CoinTicker executes a Python script to download its second stage.(Citation: CoinTicker 2019)
Kwampirs	Kwampirs downloads additional files from C2 servers.(Citation: Symantec Security Center Trojan.Kwampirs)
GuLoader	GuLoader can download further malware for execution on the victim's machine.(Citation: Medium Eli Salem GuLoader April 2021)
FunnyDream	FunnyDream can download additional files onto a compromised host.(Citation: Bitdefender FunnyDream Campaign November 2020)
Downdelph	After downloading its main config file, Downdelph downloads multiple payloads from C2 servers.(Citation: ESET Sednit Part 3)
Ember Bear	Ember Bear has used tools to download malicious code.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
Tomiris	Tomiris can download files and execute them on a victim's system.(Citation: Kaspersky Tomiris Sep 2021)
CARROTBAT	CARROTBAT has the ability to download and execute a remote file via certutil.(Citation: Unit 42 CARROTBAT November 2018)
BITSAdmin	BITSAdmin can be used to create BITS Jobs to upload and/or download files.(Citation: Microsoft BITSAdmin)
FlawedAmmyy	FlawedAmmyy can transfer files from C2.(Citation: Korean FSI TA505 2020)
Kerrdown	Kerrdown can download specific payloads to a compromised host based on OS architecture.(Citation: Unit 42 KerrDown February 2019)
ABK	ABK has the ability to download files from C2.(Citation: Trend Micro Tick November 2019)
Crimson	Crimson contains a command to retrieve files from its C2 server.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022)
APT33	APT33 has downloaded additional files and programs from its C2 server.(Citation: Symantec Elfin Mar 2019)(Citation: Microsoft Holmium June 2020)
Wizard Spider	Wizard Spider can transfer malicious payloads such as ransomware to compromised machines.(Citation: Mandiant FIN12 Oct 2021)
Bankshot	Bankshot uploads files and secondary payloads to the victim's machine.(Citation: US-CERT Bankshot Dec 2017)
Lizar	Lizar can download additional plugins, files, and tools.(Citation: BiZone Lizar May 2021)
Psylo	Psylo has a command to download a file to the system from its C2 server.(Citation: Scarlet Mimic Jan 2016)
GreyEnergy	GreyEnergy can download additional modules and payloads.(Citation: ESET GreyEnergy Oct 2018)
UPPERCUT	UPPERCUT can download and upload files to and from the victim’s machine.(Citation: FireEye APT10 Sept 2018)
Amadey	Amadey can download and execute files to further infect a host machine with additional malware.(Citation: BlackBerry Amadey 2020)
WEBC2	WEBC2 can download and execute a file.(Citation: Mandiant APT1)
LiteDuke	LiteDuke has the ability to download files.(Citation: ESET Dukes October 2019)
Explosive	Explosive has a function to download a file to the infected system.(Citation: CheckPoint Volatile Cedar March 2015)
H1N1	H1N1 contains a command to download and execute a file from a remotely hosted URL using WinINet HTTP requests.(Citation: Cisco H1N1 Part 2)
IcedID	IcedID has the ability to download additional modules and a configuration file from C2.(Citation: IBM IcedID November 2017)(Citation: Juniper IcedID June 2020)(Citation: DFIR_Quantum_Ransomware)(Citation: Latrodectus APR 2024)
NightClub	NightClub can load multiple additional plugins on an infected host.(Citation: MoustachedBouncer ESET August 2023)
	During C0026, the threat actors downloaded malicious payloads onto select compromised hosts.(Citation: Mandiant Suspected Turla Campaign February 2023)
REvil	REvil can download a copy of itself from an attacker controlled IP address to the victim machine.(Citation: Talos Sodinokibi April 2019)(Citation: McAfee Sodinokibi October 2019)(Citation: Picus Sodinokibi January 2020)
QakBot	QakBot has the ability to download additional components and malware.(Citation: Trend Micro Qakbot May 2020)(Citation: Crowdstrike Qakbot October 2020)(Citation: Trend Micro Qakbot December 2020)(Citation: Cyberint Qakbot May 2021)(Citation: Kaspersky QakBot September 2021)(Citation: Group IB Ransomware September 2020)
Volatile Cedar	Volatile Cedar can deploy additional tools.(Citation: ClearSky Lebanese Cedar Jan 2021)
RDAT	RDAT can download files via DNS.(Citation: Unit42 RDAT July 2020)
Mongall	Mongall can download files to targeted systems.(Citation: SentinelOne Aoqin Dragon June 2022)
CreepyDrive	CreepyDrive can download files to the compromised host.(Citation: Microsoft POLONIUM June 2022)
Evilnum	Evilnum can deploy additional components or tools as needed.(Citation: ESET EvilNum July 2020)
Winnti for Windows	The Winnti for Windows dropper can place malicious payloads on targeted systems.(Citation: Novetta Winnti April 2015)
Astaroth	Astaroth uses certutil and BITSAdmin to download additional malware. (Citation: Cofense Astaroth Sept 2018)(Citation: Cybereason Astaroth Feb 2019)(Citation: Securelist Brazilian Banking Malware July 2020)
Remcos	Remcos can upload and download files to and from the victim’s machine.(Citation: Riskiq Remcos Jan 2018)
Moonstone Sleet	Moonstone Sleet retrieved a final stage payload from command and control infrastructure during initial installation on victim systems.(Citation: Microsoft Moonstone Sleet 2024)
Misdat	Misdat is capable of downloading files from the C2.(Citation: Cylance Dust Storm)
PoisonIvy	PoisonIvy creates a backdoor through which remote attackers can upload files.(Citation: Symantec Darkmoon Aug 2005)
xCaon	xCaon has a command to download files to the victim's machine.(Citation: Checkpoint IndigoZebra July 2021)
TDTESS	TDTESS has a command to download and execute an additional file.(Citation: ClearSky Wilted Tulip July 2017)
BISCUIT	BISCUIT has a command to download a file from the C2 server.(Citation: Mandiant APT1 Appendix)
FIN7	FIN7 has downloaded additional malware to execute on the victim's machine, including by using a PowerShell script to launch shellcode that retrieves an additional payload.(Citation: FireEye FIN7 April 2017)(Citation: DOJ FIN7 Aug 2018)(Citation: Mandiant FIN7 Apr 2022)
Winter Vivern	Winter Vivern executed PowerShell scripts to create scheduled tasks to retrieve remotely-hosted payloads.(Citation: DomainTools WinterVivern 2021)
Uroburos	Uroburos can use a `Put` command to write files to an infected machine.(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)
TA505	TA505 has downloaded additional malware to execute on victim systems.(Citation: Cybereason TA505 April 2019)(Citation: Deep Instinct TA505 Apr 2019)(Citation: ProofPoint SettingContent-ms July 2018)
RemoteCMD	RemoteCMD copies a file over to the remote system before execution.(Citation: Symantec Buckeye)
EVILNUM	EVILNUM can download and upload files to the victim's computer.(Citation: ESET EvilNum July 2020)(Citation: Prevailion EvilNum May 2020)
BADNEWS	BADNEWS is capable of downloading additional files through C2 channels, including a new version of itself.(Citation: Forcepoint Monsoon)(Citation: PaloAlto Patchwork Mar 2018)(Citation: TrendMicro Patchwork Dec 2017)
APT41	APT41 used certutil to download additional files.(Citation: FireEye APT41 March 2020)(Citation: Crowdstrike GTR2020 Mar 2020)(Citation: Group IB APT 41 June 2021) APT41 downloaded post-exploitation tools such as Cobalt Strike via command shell following initial access.(Citation: Rostovcev APT41 2021) APT41 has uploaded Procdump and NATBypass to a staging directory and has used these tools in follow-on activities.(Citation: apt41_dcsocytec_dec2022)
HOPLIGHT	HOPLIGHT has the ability to connect to a remote host in order to upload and download files.(Citation: US-CERT HOPLIGHT Apr 2019)
	During the SolarWinds Compromise, APT29 downloaded additional malware, such as TEARDROP and Cobalt Strike, onto a compromised host following initial access.(Citation: FireEye SUNBURST Backdoor December 2020)
Nomadic Octopus	Nomadic Octopus has used malicious macros to download additional files to the victim's machine.(Citation: ESET Nomadic Octopus 2018)
BackdoorDiplomacy	BackdoorDiplomacy has downloaded additional files and tools onto a compromised host.(Citation: ESET BackdoorDiplomacy Jun 2021)
GoldenSpy	GoldenSpy constantly attempts to download and execute files from the remote C2, including GoldenSpy itself if not found on the system.(Citation: Trustwave GoldenSpy June 2020)
InvisiMole	InvisiMole can upload files to the victim's machine for operations.(Citation: ESET InvisiMole June 2018)(Citation: ESET InvisiMole June 2020)
	During C0010, UNC3890 actors downloaded tools and malware onto a compromised host.(Citation: Mandiant UNC3890 Aug 2022)
MechaFlounder	MechaFlounder has the ability to upload and download files to and from a compromised host.(Citation: Unit 42 MechaFlounder March 2019)
	During Operation Sharpshooter, additional payloads were downloaded after a target was infected with a first-stage downloader.(Citation: McAfee Sharpshooter December 2018)
BlackMould	BlackMould has the ability to download files to the victim's machine.(Citation: Microsoft GALLIUM December 2019)
GoldMax	GoldMax can download and execute additional files.(Citation: MSTIC NOBELIUM Mar 2021)(Citation: FireEye SUNSHUTTLE Mar 2021)
ftp	ftp may be abused by adversaries to transfer tools or files from an external system into a compromised environment.(Citation: Microsoft FTP)(Citation: Linux FTP)
esentutl	esentutl can be used to copy files from a given URL.(Citation: LOLBAS Esentutl)
HEXANE	HEXANE has downloaded additional payloads and malicious scripts onto a compromised host.(Citation: Kaspersky Lyceum October 2021)
metaMain	metaMain can download files onto compromised systems.(Citation: SentinelLabs Metador Sept 2022)(Citation: SentinelLabs Metador Technical Appendix Sept 2022)
OSX/Shlayer	OSX/Shlayer can download payloads, and extract bytes from files. OSX/Shlayer uses the `curl -fsL "$url" >$tmp_path` command to download malicious payloads into a temporary directory.(Citation: Carbon Black Shlayer Feb 2019)(Citation: sentinelone shlayer to zshlayer)(Citation: 20 macOS Common Tools and Techniques)(Citation: objectivesee osx.shlayer apple approved 2020)
CallMe	CallMe has the capability to download a file to the victim from the C2 server.(Citation: Scarlet Mimic Jan 2016)
POSHSPY	POSHSPY downloads and executes additional PowerShell code and Windows binaries.(Citation: FireEye POSHSPY April 2017)
HiddenWasp	HiddenWasp downloads a tar compressed archive from a download server to the system.(Citation: Intezer HiddenWasp Map 2019)
Turian	Turian can download additional files and tools from its C2.(Citation: ESET BackdoorDiplomacy Jun 2021)
ZeroT	ZeroT can download additional payloads onto the victim.(Citation: Proofpoint ZeroT Feb 2017)
BADFLICK	BADFLICK has download files from its C2 server.(Citation: Accenture MUDCARP March 2019)
Winnti Group	Winnti Group has downloaded an auxiliary program named ff.exe to infected machines.(Citation: Kaspersky Winnti April 2013)
Kasidet	Kasidet has the ability to download and execute additional files.(Citation: Zscaler Kasidet)
APT-C-36	APT-C-36 has downloaded binary data from a specified domain after the malicious document is opened.(Citation: QiAnXin APT-C-36 Feb2019)
FIN8	FIN8 has used remote code execution to download subsequent payloads.(Citation: FireEye Fin8 May 2016)(Citation: Bitdefender FIN8 July 2021)
Windshift	Windshift has used tools to deploy additional payloads to compromised hosts.(Citation: BlackBerry Bahamut)
TA551	TA551 has retrieved DLLs and installer binaries for malware execution from C2.(Citation: Unit 42 TA551 Jan 2021)
SHUTTERSPEED	SHUTTERSPEED can download and execute an arbitary executable.(Citation: FireEye APT37 Feb 2018)
POWRUNER	POWRUNER can download or upload files from its C2 server.(Citation: FireEye APT34 Dec 2017)
Mustang Panda	Mustang Panda has downloaded additional executables following the initial infection stage.(Citation: Recorded Future REDDELTA July 2020)
Bazar	Bazar can download and deploy additional payloads, including ransomware and post-exploitation frameworks such as Cobalt Strike.(Citation: Cybereason Bazar July 2020)(Citation: Zscaler Bazar September 2020)(Citation: NCC Group Team9 June 2020)(Citation: CrowdStrike Wizard Spider October 2020)
Donut	Donut can download and execute previously staged shellcode payloads.(Citation: Donut Github)
Octopus	Octopus can download additional files and tools onto the victim’s machine.(Citation: Securelist Octopus Oct 2018)(Citation: Security Affairs DustSquad Oct 2018)(Citation: ESET Nomadic Octopus 2018)
StrongPity	StrongPity can download files to specified targets.(Citation: Bitdefender StrongPity June 2020)
RTM	RTM can download additional files.(Citation: ESET RTM Feb 2017)(Citation: Unit42 Redaman January 2019)
HyperBro	HyperBro has the ability to download additional files.(Citation: Unit42 Emissary Panda May 2019)
	During Operation Honeybee, the threat actors downloaded additional malware and malicious scripts onto a compromised host.(Citation: McAfee Honeybee)
AsyncRAT	AsyncRAT has the ability to download files over SFTP.(Citation: AsyncRAT GitHub)
Cyclops Blink	Cyclops Blink has the ability to download files to target systems.(Citation: NCSC Cyclops Blink February 2022)(Citation: Trend Micro Cyclops Blink March 2022)
Dragonfly	Dragonfly has copied and installed tools for operations once in the victim environment.(Citation: US-CERT TA18-074A)
Aria-body	Aria-body has the ability to download additional payloads from C2.(Citation: CheckPoint Naikon May 2020)
MoleNet	MoleNet can download additional payloads from the C2.(Citation: Cybereason Molerats Dec 2020)
Hildegard	Hildegard has downloaded additional scripts that build and run Monero cryptocurrency miners.(Citation: Unit 42 Hildegard Malware)
Moses Staff	Moses Staff has downloaded and installed web shells to following path `C:\inetpub\wwwroot\aspnet_client\system_web\IISpool.aspx`.(Citation: Checkpoint MosesStaff Nov 2021)
Darkhotel	Darkhotel has used first-stage payloads that download additional malware from C2 servers.(Citation: Microsoft DUBNIUM June 2016)
Volt Typhoon	Volt Typhoon has downloaded an outdated version of comsvcs.dll to a compromised domain controller in a non-standard folder.(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)
Pisloader	Pisloader has a command to upload a file to the victim machine.(Citation: Palo Alto DNS Requests)
POWERSTATS	POWERSTATS can retrieve and execute additional PowerShell payloads from the C2 server.(Citation: FireEye MuddyWater Mar 2018)
MCMD	MCMD can upload additional files to a compromised host.(Citation: Secureworks MCMD July 2019)
Cobalt Strike	Cobalt Strike can deliver additional payloads to victim machines.(Citation: Talos Cobalt Strike September 2020)(Citation: Cobalt Strike Manual 4.3 November 2020)
WIRTE	WIRTE has downloaded PowerShell code from the C2 server to be executed.(Citation: Lab52 WIRTE Apr 2019)
POWERSOURCE	POWERSOURCE has been observed being used to download TEXTMATE and the Cobalt Strike Beacon payload onto victims.(Citation: FireEye FIN7 March 2017)
Gootloader	Gootloader can fetch second stage code from hardcoded web domains.(Citation: Sophos Gootloader)(Citation: SentinelOne Gootloader June 2021)
Caterpillar WebShell	Caterpillar WebShell has a module to download and upload files to the system.(Citation: ClearSky Lebanese Cedar Jan 2021)
Diavol	Diavol can receive configuration updates and additional payloads including wscpy.exe from C2.(Citation: Fortinet Diavol July 2021)
VERMIN	VERMIN can download and upload files to the victim's machine.(Citation: Unit 42 VERMIN Jan 2018)
Brute Ratel C4	Brute Ratel C4 can download files to compromised hosts.(Citation: Palo Alto Brute Ratel July 2022)(Citation: Rapid7 Fake W2 July 2024)
Mivast	Mivast has the capability to download and execute .exe files.(Citation: Symantec Backdoor.Mivast)
BRONZE BUTLER	BRONZE BUTLER has used various tools to download files, including DGet (a similar tool to wget).(Citation: Secureworks BRONZE BUTLER Oct 2017)
build_downer	build_downer has the ability to download files from C2 to the infected host.(Citation: Trend Micro Tick November 2019)
RATANKBA	RATANKBA uploads and downloads information.(Citation: Lazarus RATANKBA)(Citation: RATANKBA)
TrickBot	TrickBot downloads several additional files and saves them to the victim's machine.(Citation: Trend Micro Totbrick Oct 2016)(Citation: Bitdefender Trickbot VNC module Whitepaper 2021)
Indrik Spider	Indrik Spider has downloaded additional scripts, malware, and tools onto a compromised host.(Citation: Crowdstrike Indrik November 2018)(Citation: Symantec WastedLocker June 2020)(Citation: Mandiant_UNC2165)
Patchwork	Patchwork payloads download additional files from the C2 server.(Citation: Securelist Dropping Elephant)(Citation: TrendMicro Patchwork Dec 2017)
Bonadan	Bonadan can download additional modules from the C2 server.(Citation: ESET ForSSHe December 2018)
Cryptoistic	Cryptoistic has the ability to send and receive files.(Citation: SentinelOne Lazarus macOS July 2020)
Kinsing	Kinsing has downloaded additional lateral movement scripts from C2.(Citation: Aqua Kinsing April 2020)
BONDUPDATER	BONDUPDATER can download or upload files from its C2 server.(Citation: Palo Alto OilRig Sep 2018)
ZIRCONIUM	ZIRCONIUM has used tools to download malicious files to compromised hosts.(Citation: Zscaler APT31 Covid-19 October 2020)
	During HomeLand Justice, threat actors used web shells to download files to compromised infrastructure.(Citation: Microsoft Albanian Government Attacks September 2022)
Metamorfo	Metamorfo has used MSI files to download additional files to execute.(Citation: Medium Metamorfo Apr 2020)(Citation: FireEye Metamorfo Apr 2018)(Citation: Fortinet Metamorfo Feb 2020)(Citation: ESET Casbaneiro Oct 2019)
INC Ransom	INC Ransom has downloaded tools to compromised servers including Advanced IP Scanner. (Citation: Huntress INC Ransom Group August 2023)(Citation: Huntress INC Ransomware May 2024)
CharmPower	CharmPower has the ability to download additional modules to a compromised host.(Citation: Check Point APT35 CharmPower January 2022)
GALLIUM	GALLIUM dropped additional tools to victims during their operation, including portqry.exe, a renamed cmd.exe file, winrar, and HTRAN.(Citation: Cybereason Soft Cell June 2019)(Citation: Microsoft GALLIUM December 2019)
OutSteel	OutSteel can download files from its C2 server.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
MacMa	MacMa has downloaded additional files, including an exploit for used privilege escalation.(Citation: ESET DazzleSpy Jan 2022)(Citation: Objective-See MacMa Nov 2021)
ZIPLINE	ZIPLINE can download files to be saved on the compromised system.(Citation: Mandiant Cutting Edge January 2024)(Citation: Mandiant Cutting Edge Part 2 January 2024)
RemoteUtilities	RemoteUtilities can upload and download files to and from a target machine.(Citation: Trend Micro Muddy Water March 2021)
Chaes	Chaes can download additional files onto an infected machine.(Citation: Cybereason Chaes Nov 2020)
Metador	Metador has downloaded tools and malware onto a compromised system.(Citation: SentinelLabs Metador Sept 2022)
CORESHELL	CORESHELL downloads another dropper from its C2 server.(Citation: FireEye APT28)
FELIXROOT	FELIXROOT downloads and uploads files to and from the victim’s machine.(Citation: FireEye FELIXROOT July 2018)(Citation: ESET GreyEnergy Oct 2018)
	During C0018, the threat actors downloaded additional tools, such as Mimikatz and Sliver, as well as Cobalt Strike and AvosLocker ransomware onto the victim network.(Citation: Cisco Talos Avos Jun 2022)(Citation: Costa AvosLocker May 2022)
IMAPLoader	IMAPLoader is a loader used to retrieve follow-on payload encoded in email messages for execution on victim systems.(Citation: PWC Yellow Liderc 2023)
SUNBURST	SUNBURST delivered different payloads, including TEARDROP in at least one instance.(Citation: FireEye SUNBURST Backdoor December 2020)
Felismus	Felismus can download files from remote servers.(Citation: Forcepoint Felismus Mar 2017)
ThiefQuest	ThiefQuest can download and execute payloads in-memory or from disk.(Citation: wardle evilquest partii)
Sandworm Team	Sandworm Team has pushed additional malicious tools onto an infected system to steal user credentials, move laterally, and destroy data.(Citation: ESET Telebots Dec 2016)(Citation: US District Court Indictment GRU Unit 74455 October 2020)
UBoatRAT	UBoatRAT can upload and download files to the victim’s machine.(Citation: PaloAlto UBoatRAT Nov 2017)
Netwalker	Operators deploying Netwalker have used psexec and certutil to retrieve the Netwalker payload.(Citation: Sophos Netwalker May 2020)
Ecipekac	Ecipekac can download additional payloads to a compromised host.(Citation: Securelist APT10 March 2021)
RGDoor	RGDoor uploads and downloads files to and from the victim’s machine.(Citation: Unit 42 RGDoor Jan 2018)
	During Night Dragon, threat actors used administrative utilities to deliver Trojan components to remote systems.(Citation: McAfee Night Dragon)
Mustard Tempest	Mustard Tempest has deployed secondary payloads and third stage implants to compromised hosts.(Citation: Microsoft Ransomware as a Service)
	During Operation Wocao, threat actors downloaded additional files to the infected system.(Citation: FoxIT Wocao December 2019)
Dtrack	Dtrack’s can download and upload a file to the victim’s computer.(Citation: Securelist Dtrack)(Citation: CyberBit Dtrack)
Andariel	Andariel has downloaded additional tools and malware onto compromised hosts.(Citation: AhnLab Andariel Subgroup of Lazarus June 2018)
STEADYPULSE	STEADYPULSE can add lines to a Perl script on a targeted server to import additional Perl modules.(Citation: Mandiant Pulse Secure Zero-Day April 2021)
Ajax Security Team	Ajax Security Team has used Wrapper/Gholee, custom-developed malware, which downloaded additional malware to the infected system.(Citation: Check Point Rocket Kitten)
Empire	Empire can upload and download to and from a victim machine.(Citation: Github PowerShell Empire)
SharpDisco	SharpDisco has been used to download a Python interpreter to `C:\Users\Public\WinTN\WinTN.exe` as well as other plugins from external sources.(Citation: MoustachedBouncer ESET August 2023)
WhisperGate	WhisperGate can download additional stages of malware from a Discord CDN channel.(Citation: Microsoft WhisperGate January 2022)(Citation: Unit 42 WhisperGate January 2022)(Citation: Cisco Ukraine Wipers January 2022)(Citation: Medium S2W WhisperGate January 2022)
Elderwood	The Ritsol backdoor trojan used by Elderwood can download files onto a compromised host from a remote location.(Citation: Symantec Ristol May 2012)
StrifeWater	StrifeWater can download updates and auxiliary modules.(Citation: Cybereason StrifeWater Feb 2022)
Cannon	Cannon can download a payload for execution.(Citation: Unit42 Cannon Nov 2018)
JHUHUGIT	JHUHUGIT can retrieve an additional payload from its C2 server.(Citation: ESET Sednit Part 1)(Citation: Unit 42 Sofacy Feb 2018) JHUHUGIT has a command to download files to the victim’s machine.(Citation: Talos Seduploader Oct 2017)
Drovorub	Drovorub can download files to a compromised host.(Citation: NSA/FBI Drovorub August 2020)
RedLeaves	RedLeaves is capable of downloading a file from a specified URL.(Citation: PWC Cloud Hopper Technical Annex April 2017)
JSS Loader	JSS Loader has the ability to download malicious executables to a compromised host.(Citation: CrowdStrike Carbon Spider August 2021)
NETWIRE	NETWIRE can downloaded payloads from C2 to the compromised host.(Citation: FireEye NETWIRE March 2019)(Citation: Proofpoint NETWIRE December 2020)
APT3	APT3 has a tool that can copy files to remote machines.(Citation: FireEye Clandestine Fox)
ShadowPad	ShadowPad has downloaded code from a C2 server.(Citation: Securelist ShadowPad Aug 2017)
Lokibot	Lokibot downloaded several staged items onto the victim's machine.(Citation: Talos Lokibot Jan 2021)
P.A.S. Webshell	P.A.S. Webshell can upload and download files to and from compromised hosts.(Citation: ANSSI Sandworm January 2021)
Chimera	Chimera has remotely copied tools and malware onto targeted systems.(Citation: Cycraft Chimera April 2020)
Conficker	Conficker downloads an HTTP server to the infected machine.(Citation: SANS Conficker)
Hikit	Hikit has the ability to download files to a compromised host.(Citation: Novetta-Axiom)
Tonto Team	Tonto Team has downloaded malicious DLLs which served as a ShadowPad loader.(Citation: ESET Exchange Mar 2021)
	During C0017, APT41 downloaded malicious payloads onto compromised systems.(Citation: Mandiant APT41)
Agent.btz	Agent.btz attempts to download an encrypted binary from a specified domain.(Citation: ThreatExpert Agent.btz)
PLAINTEE	PLAINTEE has downloaded and executed additional plugins.(Citation: Rancor Unit42 June 2018)
VBShower	VBShower has the ability to download VBS files to the target computer.(Citation: Kaspersky Cloud Atlas August 2019)
Javali	Javali can download payloads from remote C2 servers.(Citation: Securelist Brazilian Banking Malware July 2020)
IndigoZebra	IndigoZebra has downloaded additional files and tools from its C2 server.(Citation: Checkpoint IndigoZebra July 2021)
ZxShell	ZxShell has a command to transfer files from a remote host.(Citation: Talos ZxShell Oct 2014)

Контрмера	Описание
Контрмеры
Network Intrusion Prevention	Use intrusion detection signatures to block traffic at network boundaries.
Remote File Copy Mitigation	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware or unusual data transfer over known tools and protocols like FTP can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. (Citation: University of Birmingham C2)

Обнаружение

Monitor for file creation and files transferred into the network. Unusual processes with external network connections creating files on-system may be suspicious. Use of utilities, such as ftp, that does not normally occur may also be suspicious. Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Specifically, for the finger utility on Windows and Linux systems, monitor command line or terminal execution for the finger command. Monitor network activity for TCP port 79, which is used by the finger utility, and Windows netsh interface portproxy modifications to well-known ports such as 80 and 443. Furthermore, monitor file system for the download/creation and execution of suspicious files, which may indicate adversary-downloaded payloads. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2)

Передача инструментов из внешней сети

Примеры процедур

Контрмеры

Обнаружение

Ссылки