ID	E1105
Objective(s)	Command and Control, Lateral Movement, Persistence
Related ATT&CK Techniques	Ingress Tool Transfer (T1105)
Version	2.2
Created	1 August 2019
Last Modified	28 April 2024

Ingress Tool Transfer

Malware may copy files from an external system to a system on a compromised network.

Note that this behavior is separate from possible execution (installation) of the file, which is covered by the Install Additional Program (B0023) behavior.

See ATT&CK: Ingress Tool Transfer (T1105).

Use in Malware

Name	Date	Method	Description
Poison Ivy	2005	--	After the Poison Ivy implant is running on the target machine, the attacker can use a Windows GUI controller to control the target computer. [1]
DarkComet	2008	--	DarkComet can download files from a remote repository upon instruction. [2]
Shamoon	2012	--	Shamoon creates a folder on remote computers and then copies its executables (Shamoon and Filerase) into that directory. [3]
CozyCar	2010	--	CozyCar requests a file using SSL to a C2 domain. [4]
Vobfus	2016	--	Vobfus downloads its latest version from a remote server. [5]
TEARDROP	2018	--	TEARDROP executes the decrypted, embedded code buffer, which is a Cobalt Strike RAT. [6]
Matanbuchus	2021	--	Malware downloads DLLs from the hardcoded URL/remote server. [7] [8]
GoBotKR	2019	--	GoBotKR can download additional files and update itself. [9]
Gamut	2014	--	Gamut receives files from the C2. [10]
UP007	2016	--	UP007 downloads files from the C2. [11]

Detection

Tool: CAPE	Mapping	APIs
suspicious_mpcmdrun_use	Ingress Tool Transfer (E1105)	--
network_document_file	Ingress Tool Transfer (E1105)	URLDownloadToFileW, HttpOpenRequestW, send, InternetCrackUrlW, InternetCrackUrlA, WSASend, URLDownloadToCacheFileW