Adversaries may transfer tools or other files from an external system onto a compromised device to facilitate follow-on actions. Files may be copied from an external adversary-controlled system through the command and control channel or through alternate protocols with another tool such as FTP.
| ID | Name | Description |
|---|---|---|
| S1061 | AbstractEmu |
AbstractEmu can receive files from the C2 at runtime.[1] |
| C0033 | C0033 |
During C0033, PROMETHIUM used StrongPity to receive files from the C2 and execute them via the parent application.[2] |
| S1083 | Chameleon |
Chameleon has downloaded HTML overlay pages after installation.[3] |
| S1225 | CherryBlos |
CherryBlos has received configuration files from the C2 server.[4] |
| S9005 | DocSwap |
DocSwap has the ability to upload and download files via socket communication.[5][6] |
| S1231 | GodFather |
GodFather has downloaded Google Play Store, Google Play services and Google Services Framework APK to a virtual folder.[7] |
| S1185 | LightSpy |
LightSpy has retrieved files from the C2 server.[8][9] Examples of files from the C2 are |
| S0485 | Mandrake |
Mandrake can install attacker-specified components or applications.[11] |
| S0407 | Monokle | |
| C0054 | Operation Triangulation |
During Operation Triangulation, the threat actors downloaded subsequent stages from the C2.[13][14] |
| S1126 | Phenakite |
Phenakite can download additional malware to the victim device.[15] |
| S0326 | RedDrop |
RedDrop uses ads or other links within websites to encourage users to download the malicious apps using a complex content distribution network (CDN) and series of network redirects. RedDrop also downloads additional components (APKs, JAR files) from different C2 servers.[16] |
| S1055 | SharkBot | |
| S1195 | SpyC23 |
SpyC23 can download more malware to the victim device.[18][19][20] |
| S1082 | Sunbird |
Sunbird can download adversary specified content from FTP shares.[21] |
| S1216 | TriangleDB |
TriangleDB has loaded additional modules stored in memory.[14] |
| S0418 | ViceLeaker |
ViceLeaker can download attacker-specified files.[22] |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0718 | Detection of Ingress Tool Transfer | AN1848 |
The defender correlates an application establishing outbound retrieval to a non-baselined external source with immediate local creation of a new executable, module, staged payload, overlay asset, or secondary file in app-controlled or shared storage, followed by optional load, invocation, handoff, or repeat retrieval behavior. The analytic prioritizes Android-observable effects: network download activity, DownloadManager or direct HTTP retrieval, file creation in package-specific or external paths, and execution context inconsistent with recent user interaction or the app’s declared role. |
| AN1849 |
The defender correlates managed-app network retrieval from a non-baselined external source with immediate creation of a new local artifact, staged resource, module-like file, or opaque payload inside the app container, followed by optional dynamic loading, handoff, or repeat retrieval behavior. Because iOS offers weaker direct visibility into tool staging internals than Android in many environments, the analytic anchors first on network acquisition plus managed app identity and then strengthens confidence with file creation or process-activity effects where mobile telemetry is available. |