ID	B0023
Objective(s)	Execution
Related ATT&CK Techniques	None
Version	2.1
Created	1 August 2019
Last Modified	13 September 2023

Install Additional Program

Malware installs another, different program on the system. The additional program can be any secondary module as exemplified by backdoors, malicious drivers, kernel modules, and OS X Apps.

There are various ways to accomplish the installation. For example, malicious code can beacon to a C2 node for download of an additional program including updates (see Ingress Tool Transfer (E1105)), which is then executed and installed [1]. A threat actor can achieve the same goal using a dropper embedded in the binary files of the original executable or using API calls to extract resource files that are in fact hidden executables. Extracted files are then dropped to the disk.

Examples of droppers include malicious • Microsoft Excel files • ISO image files • self-extracting zip or archives files, which in turn may contain a second stage dropper as part of the payload [2] [3].

Droppers may be described as “single stage” or “two stage.” While the former embeds the malicious code internally, the latter installs itself before downloading additional code from a remote location [4].

Use in Malware

Name	Date	Method	Description
WebCobra	2018	--	The malware downloads and executes Claymore's Zcash miner from a remote server. [5]
Geneio	2015	--	Malware tricks OS X keychain to create application files. Malware also installs the browser extension Omnibar.safariextz. [14]
GoBotKR	2019	--	GoBotKR reinstalls its running instance if it is removed. [7]
MazarBot	2016	--	MazarBot installs a backdoor. [18]
Mebromi	2011	--	Malware contains a dropper that installs additional programs like Cbrom.exe. [15]
YiSpecter	2015	--	The malware can download and install arbitrary iOS apps. [17]
UP007	2016	--	The malware is a dropper that creates multiple files. [8]
CozyCar	2010	--	Upon execution, CozyCar drops a decoy file and a secondary dropper. [9]
Clipminer	2011	--	Clipminer drops a file masquerading as a Control Panel (CPL) file. [10]
Vobfus	2016	--	Vobfus downloads malware from other malware families. [11]
Matanbuchus	2021	--	Malware drops the first loader which is responsible for loading the main loader into memory. [12] [13]
SearchAwesome	2018	--	The malware installs an open-source program called mitmproxy. [16]
Dark Comet	2008	--	The malware contains an embedded PE file. [19]
Gamut	2014	--	Gamut contains an embedded PE file. [19]
Redhip	2011	--	Redhip contains an embedded PE file. [19]
ElectroRAT	2020	--	ElectroRat looks for wallets to steal cryptocurrency. [20]