Technique:  Ingress Tool Transfer
During the 2015 Ukraine Electric Power Attack, It pushed additional malicious tools onto an infected system to steal user credentials, move laterally, and destroy data.
ABK has the ability to download files from C2.
Action RAT has the ability to download additional payloads onto an infected machine.
Agent Tesla can download additional files for execution on the victim’s machine.
Agent.btz attempts to download an encrypted binary from a specified domain.
It has used Wrapper/Gholee, custom-developed malware, which downloaded additional malware to the infected system.
Amadey can download and execute files to further infect a host machine with additional malware.
Anchor can download additional payloads.
It has downloaded additional tools and malware onto compromised hosts.
ANDROMEDA can download additional payloads from C2.
It has downloaded binary data from a specified domain after the malicious document is opened.
It can upload a file to the victim’s machine.
It has downloaded additional files, including by using a first-stage downloader to contact the C2 server to obtain the second-stage implant.
It has downloaded additional tools and malware onto compromised networks.
It has a tool that can copy files to remote machines.
It has added JavaScript to victim websites to download additional frameworks that profile and compromise website visitors.
It has downloaded additional files and programs from its C2 server.
It has downloaded second stage malware from compromised websites.
It used a backdoor, NESTEGG, that has the capability to download and upload files to and from a victim’s machine.
It has downloaded tools to compromised hosts.
It used certutil to download additional files.
It has downloaded additional malware onto compromised hosts.
Aria-body has the ability to download additional payloads from C2.
Astaroth uses certutil and BITSAdmin to download additional malware.
AsyncRAT has the ability to download files over SFTP.
Attor can download additional plugins, updates and other files.
AuditCred can download files and additional malware.
Avenger has the ability to download files from C2 to a compromised host.
Azorult can download and execute additional files. Azorult has also downloaded a ransomware payload called Hermes.
BabyShark has downloaded additional files from the C2.
BackConfig can download and execute additional payloads on a compromised host.
Backdoor.Oldrea can download additional modules from C2.
It has downloaded additional files and tools onto a compromised host.
BADFLICK has download files from its C2 server.
BADHATCH has the ability to load a second stage malicious DLL file onto a compromised machine.
BADNEWS is capable of downloading additional files through C2 channels, including a new version of itself.
BadPatch can download and execute or update malware.
Bandook can download files to the system.
Bankshot uploads files and secondary payloads to the victim's machine.
Bazar can download and deploy additional payloads, including ransomware and post-exploitation frameworks such as Cobalt Strike.
BBK has the ability to download files from C2 to the infected host.
BendyBear is designed to download an implant from a C2 server.
BISCUIT has a command to download a file from the C2 server.
Bisonal has the capability to download files to execute on the victim’s machine.
BITSAdmin can be used to create BITS Jobs to upload and/or download files.
It has downloaded additional malware and tools onto a compromised host.
BlackMould has the ability to download files to the victim's machine.
BLINDINGCAN has downloaded files to a victim machine.
BLUELIGHT can download additional files onto the host.
Bonadan can download additional modules from the C2 server.
BONDUPDATER can download or upload files from its C2 server.
BoomBox has the ability to download next stage malware components to a compromised system.
BoxCaon can download files.
Briba downloads files onto infected hosts.
It has used various tools to download files, including DGet (a similar tool to wget).
Brute Ratel C4 can download files to compromised hosts.
build_downer has the ability to download files from C2 to the infected host.
Bumblebee can download and execute additional payloads including through the use of a Dex command.
Bundlore can download and execute new versions of itself.
During C0010, UNC3890 actors downloaded tools and malware onto a compromised host.
During C0015, the threat actors downloaded additional tools and files onto a compromised network.
During C0017, It downloaded malicious payloads onto compromised systems.
During C0018, the threat actors downloaded additional tools, such as Mimikatz and Sliver, as well as Cobalt Strike and AvosLocker ransomware onto the victim network.
During C0021, the threat actors downloaded additional tools and files onto victim machines.
During C0026, the threat actors downloaded malicious payloads onto select compromised hosts.
During C0027, It downloaded tools using victim organization systems.
Calisto has the capability to upload and download files to the victim's machine.
CallMe has the capability to download a file to the victim from the C2 server.
Cannon can download a payload for execution.
Carberp can download and execute new plugins from the C2 server.
Cardinal RAT can download and execute additional payloads.
CARROTBALL has the ability to download and install a remote payload.
CARROTBAT has the ability to download and execute a remote file via certutil.
Caterpillar WebShell has a module to download and upload files to the system.
certutil can be used to download files from a given URL.
Chaes can download additional files onto an infected machine.
CharmPower has the ability to download additional modules to a compromised host.
ChChes is capable of downloading files, including additional modules.
It has remotely copied tools and malware onto targeted systems.
China Chopper's server component can download remote files.
CHOPSTICK is capable of performing remote file transmission.
Chrommme can download its code from C2.
CloudDuke downloads and executes additional malware from either a Web address or a Microsoft OneDrive account.
cmd can be used to copy files to/from a remotely connected external system.
It has used public sites such as github.com and sendspace.com to upload files and then download them to victim computers. The group's JavaScript backdoor is also capable of downloading files.
Cobalt Strike can deliver additional payloads to victim machines.
CoinTicker executes a Python script to download its second stage.
Conficker downloads an HTTP server to the infected machine.
It has downloaded additional files and payloads onto a compromised host following initial access.
CookieMiner can download additional scripts from a web server.
CORESHELL downloads another dropper from its C2 server.
CostaBricks has been used to load SombRAT onto a compromised host.
During CostaRicto, the threat actors downloaded malware and tools onto a compromised host.
CreepyDrive can download files to the compromised host.
Crimson contains a command to retrieve files from its C2 server.
Cryptoistic has the ability to send and receive files.
CSPY Downloader can download additional tools to a compromised host.
Cuba can download files from its C2 server.
Cyclops Blink has the ability to download files to target systems.
Dacls can download its payload from a C2 server.
DanBot can download additional files to a targeted system.
DarkComet can load any files onto the infected machine to execute.
It has used first-stage payloads that download additional malware from C2 servers.
DarkTortilla can download additional packages for keylogging, cryptocurrency mining, and other capabilities; it can also retrieve malicious payloads such as Agent Tesla, AsyncRat, NanoCore, RedLine, Cobalt Strike, and Metasploit.
Daserf can download remote files.
DDKONG downloads and uploads files on the victim’s machine.
DEATHRANSOM can download files to a compromised host.
Denis deploys additional backdoors and hacking tools to the system.
Diavol can receive configuration updates and additional payloads including wscpy.exe from C2.
Dipsind can download remote files.
Disco can download files to targeted systems via SMB.
DnsSystem can download files to compromised systems after receiving a command with the string downloaddd.
DOGCALL can download and execute additional payloads.
Doki has downloaded scripts from C2.
Donut can download and execute previously staged shellcode payloads.
down_new has the ability to download files to the compromised host.
After downloading its main config file, Downdelph downloads multiple payloads from C2 servers.
It has copied and installed tools for operations once in the victim environment.
DRATzarus can deploy additional tools onto an infected machine.
DropBook can download and execute additional files.
Drovorub can download files to a compromised host.
Dtrack’s can download and upload a file to the victim’s computer.
Dyre has a command to download and executes additional files.
Ecipekac can download additional payloads to a compromised host.
Egregor has the ability to download files from its C2 server.
The Ritsol backdoor trojan used by It can download files onto a compromised host from a remote location.
Elise can download additional files from the C2 server for execution.
It has used tools to download malicious code.
Emissary has the capability to download files from the C2 server.
Empire can upload and download to and from a victim machine.
esentutl can be used to copy files from a given URL.
EvilBunny has downloaded additional Lua scripts from the C2.
EVILNUM can download and upload files to the victim's computer.
It can deploy additional components or tools as needed.
Exaramel for Linux has a command to download a file from  and to a remote C2 server.
Explosive has a function to download a file to the infected system.
Felismus can download files from remote servers.
FELIXROOT downloads and uploads files to and from the victim’s machine.
It has downloaded additional tools and malware to compromised systems.
It has downloaded additional malware to execute on the victim's machine, including by using a PowerShell script to launch shellcode that retrieves an additional payload.
It has used remote code execution to download subsequent payloads.
Flagpro can download additional malware from the C2 server.
FlawedAmmyy can transfer files from C2.
FoggyWeb can receive additional malicious components from an actor controlled C2 server and execute them on a compromised AD FS server.
It has downloaded additional tools including PsExec directly to endpoints.
During Frankenstein, the threat actors downloaded files and tools onto a victim machine.
ftp may be abused by adversaries to transfer tools or files from an external system into a compromised environment.
FunnyDream can download additional files onto a compromised host.
During FunnyDream, the threat actors downloaded additional droppers and backdoors onto a compromised system.
FYAnti can download additional payloads to a compromised host.
It dropped additional tools to victims during their operation, including portqry.exe, a renamed cmd.exe file, winrar, and HTRAN.
It has downloaded additional malware and tools onto a compromised host.
Gazer can execute a task to download a file.
Gelsemium can download additional plug-ins to a compromised host.
gh0st RAT can download files to the victim’s machine.
Gold Dragon can download additional components from the C2 server.
GoldenSpy constantly attempts to download and execute files from the remote C2, including GoldenSpy itself if not found on the system.
GoldMax can download and execute additional files.
It malware can download additional files from C2 servers.
Grandoreiro can download its second stage from a hardcoded URL within the loader's code.
GreyEnergy can download additional modules and payloads.
GrimAgent has the ability to download and execute additional payloads.
GuLoader can download further malware for execution on the victim's machine.
H1N1 contains a command to download and execute a file from a remotely hosted URL using WinINet HTTP requests.
It has downloaded malware and tools--including Nishang and PowerCat--onto a compromised host.
Hancitor has the ability to download additional files from C2.
can download and execute a second-stage payload.
Helminth can download additional files.
It has downloaded additional payloads and malicious scripts onto a compromised host.
Hi-Zor has the ability to upload and download files from its C2 server.
HiddenWasp downloads a tar compressed archive from a download server to the system.
Hikit has the ability to download files to a compromised host.
Hildegard has downloaded additional scripts that build and run Monero cryptocurrency miners.
HOPLIGHT has the ability to connect to a remote host in order to upload and download files.
HotCroissant has the ability to upload a file from the command and control (C2) server to the victim machine.
HTTPBrowser is capable of writing a file to the compromised system from the C2 server.
Hydraq creates a backdoor through which remote attackers can download files and additional malware components.
HyperBro has the ability to download additional files.
IcedID has the ability to download additional modules and a configuration file from C2.
It has downloaded additional files and tools from its C2 server.
It has downloaded additional scripts, malware, and tools onto a compromised host.
Industroyer downloads a shellcode payload from a remote C2 server and loads it into memory.
InvisiMole can upload files to the victim's machine for operations.
Ixeshe can download and execute additional files.
Javali can download payloads from remote C2 servers.
JHUHUGIT can retrieve an additional payload from its C2 server. JHUHUGIT has a command to download files to the victim’s machine.
JPIN can download files and upgrade itself.
jRAT can download and execute files.
JSS Loader has the ability to download malicious executables to a compromised host.
KARAE can upload and download files, including second-stage malware.
Kasidet has the ability to download and execute additional files.
Kazuar downloads additional plug-ins to load on the victim’s machine, including the ability to upgrade and replace its own binary.
It has used tools to download files to compromised machines.
Kerrdown can download specific payloads to a compromised host based on OS architecture.
Kessel can download additional modules from the C2 server.
Kevin can download files to the compromised host.
KeyBoy has a download and upload functionality.
KEYMARBLE can upload files to the victim’s machine and can download additional payloads.
KGH_SPY has the ability to download and execute code from remote servers.
It has downloaded additional scripts, tools, and malware onto victim systems.
Kinsing has downloaded additional lateral movement scripts from C2.
Kivars has the ability to download and execute files.
Koadic can download additional files and tools.
KOCTOPUS has executed a PowerShell command to download a file to the system.
KONNI can download files and execute them on the victim’s machine.
Kwampirs downloads additional files from C2 servers.
It has downloaded files, malware, and tools from its C2 onto a compromised host.
It had downloaded additional tools to a compromised host.
It has downloaded additional scripts and files from adversary-controlled servers.
LightNeuron has the ability to download and execute additional files.
Linfo creates a backdoor through which remote attackers can download files onto compromised hosts.
LiteDuke has the ability to download files.
LitePower has the ability to download payloads containing system commands to a compromised host.
Lizar can download additional plugins, files, and tools.
Lokibot downloaded several staged items onto the victim's machine.
LoudMiner used SCP to update the miner from the C2.
LOWBALL uses the Dropbox API to request two files, one of which is the same file as the one dropped by the malicious email attachment. This is most likely meant to be a mechanism to update the compromised host with a new version of the LOWBALL malware.
Lucifer can download and execute a replica of itself using certutil.
It has downloaded additional malware and tools onto a compromised host.
It can download additional files for execution on the victim’s machine.
MacMa has downloaded additional files, including an exploit for used privilege escalation.
macOS.OSAMiner has used curl to download a Stripped Payloads from a public facing adversary-controlled webpage.
Mafalda can download additional files onto the compromised host.
It has downloaded additional code and files from servers onto victims.
MarkiRAT can download additional files and tools from its C2 server, including through the use of BITSAdmin.
MCMD can upload additional files to a compromised host.
MechaFlounder has the ability to upload and download files to and from a compromised host.
Melcoz has the ability to download additional files to a compromised host.
It has installed updates and new malware on victims.
It has downloaded tools and malware onto a compromised system.
metaMain can download files onto compromised systems.
Metamorfo has used MSI files to download additional files to execute.
Meteor has the ability to download additional files for execution on the victim's machine.
Micropsia can download and execute an executable from the C2 server.
Milan has received files from C2 and stored them in log folders beginning with the character sequence a9850d2f.
MiniDuke can download additional encrypted backdoors onto the victim via GIF files.
Mis-Type has downloaded additional malware and files onto a compromised host.
Misdat is capable of downloading files from the C2.
Mivast has the capability to download and execute .exe files.
MobileOrder has a command to download a file from the C2 server to the victim mobile device's SD card.
MoleNet can download additional payloads from the C2.
It used executables to download malicious files from different sources.
Mongall can download files to targeted systems.
More_eggs can download and launch additional payloads.
It has downloaded and installed web shells to following path C:\inetpub\wwwroot\aspnet_client\system_web\IISpool.aspx.
Mosquito can upload and download files to the victim.
It has used malware that can upload additional files to the victim’s machine.
It has downloaded additional executables following the initial infection stage.
NanHaiShu can download additional files from URLs.
NanoCore has the capability to download and activate additional modules for execution.
NavRAT can download files remotely.
NDiskMonitor can download and execute a file from given URL.
Nebulae can download files from C2.
Neoichor can download additional files onto a compromised host.
Nerex creates a backdoor through which remote attackers can download files onto a compromised host.
Operators deploying Netwalker have used psexec and certutil to retrieve the Netwalker payload.
NETWIRE can downloaded payloads from C2 to the compromised host.
Nidiran can download and execute files.
During Night Dragon, threat actors used administrative utilities to deliver Trojan components to remote systems.
NightClub can load multiple additional plugins on an infected host.
njRAT can download files to the victim’s machine.
NOKKI has downloaded a remote module for execution.
It has used malicious macros to download additional files to the victim's machine.
Octopus can download additional files and tools onto the victim’s machine.
It can download remote files onto victims.
Okrum has built-in commands for uploading, downloading, and executing files to the system.
OopsIE can download files from its C2 server to the victim's machine.
During Operation Dream Job, It downloaded multistage malware and tools onto a compromised host.
During Operation Honeybee, the threat actors downloaded additional malware and malicious scripts onto a compromised host.
During Operation Sharpshooter, additional payloads were downloaded after a target was infected with a first-stage downloader.
During Operation Wocao, threat actors downloaded additional files to the infected system.
Orz can download files onto the victim.
OSX/Shlayer can download payloads, and extract bytes from files. OSX/Shlayer uses the curl -fsL "$url" >$tmp_path command to download malicious payloads into a temporary directory.
OSX_OCEANLOTUS.D has a command to download and execute a file on the victim’s machine.
OutSteel can download files from its C2 server.
P.A.S. Webshell can upload and download files to and from compromised hosts.
P8RAT can download additional payloads to a target system.
Pandora can load additional drivers and files onto a victim machine.
Pasam creates a backdoor through which remote attackers can upload files.
It payloads download additional files from the C2 server.
Penquin can execute the command code do_download to retrieve remote files from C2.
Peppy can download and execute remote files.
PipeMon can install additional modules via C2 commands.
Pisloader has a command to upload a file to the victim machine.
PLAINTEE has downloaded and executed additional plugins.
It has transferred files using the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel.
PLEAD has the ability to upload and download files to and from an infected host.
PlugX has a module to download and execute files on the compromised machine.
PoetRAT has the ability to copy files and download/upload files into C2 channels using FTP and HTTPS.
PoisonIvy creates a backdoor through which remote attackers can upload files.
PolyglotDuke can retrieve payloads from the C2 server.
Pony can download additional files onto the infected system.
POSHSPY downloads and executes additional PowerShell code and Windows binaries.
PowerDuke has a command to download a file.
PowerLess can download additional payloads to a compromised host.
PowerPunch can download payloads from adversary infrastructure.
POWERSOURCE has been observed being used to download TEXTMATE and the Cobalt Strike Beacon payload onto victims.
POWERSTATS can retrieve and execute additional PowerShell payloads from the C2 server.
POWRUNER can download or upload files from its C2 server.
CostaBricks can download additional payloads onto a compromised host.
Psylo has a command to download a file to the system from its C2 server.
Pteranodon can download and execute additional files.
PUNCHBUGGY can download additional files and payloads to compromised hosts.
Pupy can upload and download to/from a victim machine.
QakBot has the ability to download additional components and malware.
QuasarRAT can download files to the victim’s machine and execute them.
QuietSieve can download and execute payloads on a target host.
RainyDay can download files to a compromised host.
It has downloaded additional malware, including by using certutil.
RARSTONE downloads its backdoor component from a C2 server and loads it directly into memory.
RATANKBA uploads and downloads information.
RCSession has the ability to drop additional files to an infected machine.
RDAT can download files via DNS.
RedLeaves is capable of downloading a file from a specified URL.
RegDuke can download files from C2.
Remcos can upload and download files to and from the victim’s machine.
RemoteCMD copies a file over to the remote system before execution.
RemoteUtilities can upload and download files to and from a target machine.
Remsec contains a network loader to receive executable modules from remote attackers and run them on the local victim. It can also upload and download files over HTTP and HTTPS.
Revenge RAT has the ability to upload and download files.
REvil can download a copy of itself from an attacker controlled IP address to the victim machine.
RGDoor uploads and downloads files to and from the victim’s machine.
It used malware to download additional malicious files to the target system.
RogueRobin can save a new file to the system from the C2 server.
ROKRAT can retrieve additional malicious payloads from its C2 server.
It can download additional files.
S-Type can download additional files onto a compromised host.
Saint Bot can download additional files onto a compromised host.
Sakula has the capability to download files.
It has pushed additional malicious tools onto an infected system to steal user credentials, move laterally, and destroy data.
Sardonic has the ability to upload additional malicious files to a compromised machine.
SDBbot has the ability to download a DLL from C2 to a compromised host.
SeaDuke is capable of uploading and downloading files.
Seasalt has a command to download additional files.
SEASHARPEE can download remote files onto victims.
ServHelper may download additional files to execute.
Seth-Locker has the ability to download and execute files on a compromised host.
ShadowPad has downloaded code from a C2 server.
Shamoon can download an executable to run on the victim.
Shark  can download additional files from its C2 via HTTP or DNS.
SharpDisco has been used to download a Python interpreter to C:\Users\Public\WinTN\WinTN.exe as well as other plugins from external sources.
SharpStage has the ability to download and execute additional payloads via a DropBox API.
SHARPSTATS has the ability to upload and download files.
ShimRat can download additional files.
ShimRatReporter had the ability to download additional payloads.
SHUTTERSPEED can download and execute an arbitary executable.
Sibot can download and execute a payload onto a compromised system.
It has delivered trojanized executables via spearphishing emails that contacts actor-controlled servers to download malicious payloads.
SideTwist has the ability to download additional files.
It has used LNK files to download remote files to the victim's network.
It has downloaded additional modules and malware to victim’s machines.
SILENTTRINITY can load additional files and tools, including Mimikatz.
Skidmap has the ability to download files on an infected host.
Sliver can upload files from the C2 server to the victim machine using the upload command.
SLOTHFULMEDIA has downloaded files onto a victim machine.
SLOWDRIFT downloads additional payloads.
Small Sieve has the ability to download files.
Smoke Loader downloads a new version of itself once it has installed. It also downloads additional plugins.
SMOKEDHAM has used Powershell to download UltraVNC and ngrok from third-party file sharing sites.
Snip3 can download additional payloads to compromised systems.
SodaMaster has the ability to download additional payloads from C2 to the targeted system.
During the SolarWinds Compromise, It downloaded additional malware, such as TEARDROP and Cobalt Strike, onto a compromised host following initial access.
SombRAT has the ability to download and execute additional payloads.
SoreFang can download additional payloads from C2.
SpeakUp downloads and executes additional files from a remote server.
SpicyOmelette can download malicious files from threat actor controlled AWS URL's.
SQLRat can make a direct SQL connection to a Microsoft database controlled by the attackers, retrieve an item from the bindata table, then write and execute the file on disk.
Squirrelwaffle has downloaded and executed additional encoded payloads.
StoneDrill has downloaded and dropped temporary files containing scripts; it additionally has a function to upload files from the victims machine.
StrifeWater can download updates and auxiliary modules.
StrongPity can download files to specified targets.
SUNBURST delivered different payloads, including TEARDROP in at least one instance.
SVCReady has the ability to download additional tools such as the RedLine Stealer to an infected host.
SysUpdate has the ability to download files to a compromised host.
It has used malicious scripts and macros with the ability to download additional payloads.
It has downloaded additional malware to execute on victim systems.
It has retrieved DLLs and installer binaries for malware execution from C2.
Taidoor has downloaded additional files onto a compromised host.
TAINTEDSCRIBE can download additional modules from its C2 server.
TDTESS has a command to download and execute an additional file.
It has the curl and wget commands as well as batch scripts to download new tools.
ThiefQuest can download and execute payloads in-memory or from disk.
It has downloaded additional malware and tools, including through the use of certutil, onto a compromised host .
ThreatNeedle can download additional tools to enable lateral movement.
TinyIt has the ability to act as a second-stage dropper used to infect the system with additional malware.
Tomiris can download files and execute them on a victim's system.
It has downloaded malicious DLLs which served as a ShadowPad loader.
TrickBot downloads several additional files and saves them to the victim's machine.
Trojan.Karagany can upload, download, and execute files on the victim.
It has used a delivered trojan to download additional files.
TSCookie has the ability to upload and download files to and from the infected host.
Turian can download additional files and tools from its C2.
It has used shellcode to download Meterpreter after compromising a victim.
TURNEDUP is capable of downloading additional files.
TYPEFRAME can upload and download files to the victim’s machine.
UBoatRAT can upload and download files to the victim’s machine.
Unknown Logger is capable of downloading remote files.
UPPERCUT can download and upload files to and from the victim’s machine.
Uroburos can use a Put command to write files to an infected machine.
Ursnif has dropped payload and configuration files to disk. Ursnif has also been used to download and execute additional payloads.
Valak has downloaded a variety of modules and payloads to the compromised host, including IcedID and NetSupport Manager RAT-based malware.
VaporRage has the ability to download malicious shellcode to compromised systems.
Vasport can download files.
VBShower has the ability to download VBS files to the target computer.
VERMIN can download and upload files to the victim's machine.
It can deploy additional tools.
Volgmer can download remote files and additional payloads to the victim's machine.
WarzoneRAT can download and execute additional files.
Waterbear can receive and load executables from remote C2 servers.
WEBC2 can download and execute a file.
WellMail can receive data and executable scripts from C2.
WellMess can write files to a compromised host.
WhisperGate can download additional stages of malware from a Discord CDN channel.
It has the ability to download additional tools from the C2.
Wiarp creates a backdoor through which remote attackers can download files.
It has used tools to deploy additional payloads to compromised hosts.
Winnti for Linux has the ability to deploy modules directly from command and control (C2) servers, possibly for remote command execution, file exfiltration, and socks5 proxying on the infected host.
The Winnti for Windows dropper can place malicious payloads on targeted systems.
It has downloaded an auxiliary program named ff.exe to infected machines.
It has downloaded PowerShell code from the C2 server to be executed.
It can transfer malicious payloads such as ransomware to compromised machines.
Woody RAT can download files from its C2 server, including the .NET DLLs, WoodySharpExecutor and WoodyPowerSession.
Xbash can download additional malicious files from its C2 server.
xCaon has a command to download files to the victim's machine.
XCSSET downloads browser specific AppleScript modules using a constructed URL with the curl command, https://" & domain & "/agent/scripts/" & moduleName & ".applescript.
YAHOYAH uses HTTP GET requests to download other files that are executed in memory.
Zebrocy obtains additional code to execute on the victim's machine, including the downloading of a secondary payload.
ZeroT can download additional payloads onto the victim.
Zeus Panda can download additional malware plug-in modules and execute them on the victim’s machine.
ItM has used tools to download malicious files to compromised hosts.
ZLib has the ability to download files.
Zox can download files to a compromised machine.
ZxShell has a command to transfer files from a remote host.
ZxxZ can download and execute additional files.