T1105 Ingress Tool Transfer in real malware
ATT&CK technique T1105 Ingress Tool Transfer appears in 9562 publicly analyzed samples on MalwareAnalyzer by Cyble, 9.5% of the analyzed corpus. Seven-day prevalence is rising (4455 recent vs 1566 prior). Most associated families: Mira, Zusy, VJadtre.
Tactics: command-and-control
Prevalence in the corpus
- Samples exhibiting T1105: 9562
- Share of analyzed corpus: 9.5%
- Last 7 days: 4455 · prior 7 days: 1566 (rising)
Malware families using T1105
Example samples
- aaa564183ea8dc8d7a743b8dce17d08b018fe0ed45e8cef11181d1db3edc8263 - malicious
- 81979980f9cb60d75f4e5b8c248d2efff005e75c69ed94f8b59050b4ba5d8a24 - malicious
- b7ed730b6386f5160e5ea1f10c9dc35790567b98ba22aa6893eee6ce27bba3a0 - malicious
- 9d96165cf2a52ed821566f7f501c3782d83f8b5969dea157a9d9c34470062823 - malicious
- 7d3a8dfa1514ae9e6f8f31bd548c5e13d8fa8407dbc289c59ab1726dd5cf984d - malicious
- 6afc2739d77c9ecebb8752f0e6e6c05da52801ccd2d98280768346b4dae4974c - malicious
- b1553dba597d062aecbae96d079f9ad873861f46f35da41da425095dfedbd455 - malicious
- cfac9a442c94a276fee001d8c862c893d8d250d6949ad7ab114931e542c043e5 - malicious
- 2f5e2a5a9ae675d428056d49102dc222c94832dc21226089e7325d4b2d215884 - malicious
- 32dd57228fc240d2fd5b8c900ab2fd36a33ffad503e06508ccdd338781d435c7 - malicious
- b577cfc1219e216d10e306c23b27fe909ee517eb5eed84b5101bcf34a16c4599 - malicious
- 4dd005e76694178ed5d7f13c9420a8c4e212e14376fb1f060284506762325070 - malicious
- ea95e0523607e61c760d5f7c453d803d094f6b3ee69c180c951e8f7e0b51ba7a - malicious
- bc093a771db4eec93cf8dc93bc36b2def20b3b1c07c6ce0422325d51da5d1153 - malicious
- c190e2afa3434964f7e4a725a1d0c8f579c658a658c1ade44158d9f4425b4bac - malicious
- c8161b4bed1a0d139c04b34954478fefc68350d8f6e5d8d47845fd8917bd42dc - malicious
- 80c318e5b0d531cf153217252d40e12c074fd4dbc4dcc8a4bf77b18241d8368f - malicious
- c829a6a98164d4cdc46f6a8c5d95aaca23392554ee8632fe1c854613b1f9060f - malicious
- a614c86e6c11abfc4cd1992ee5bee2a6c0804f7f897ab55fbb1c94251525000b - malicious
- b2b4a295360c38e2659d40ad2b6bdde93cad38bb83d9eb39cb1972cf9e6817e8 - malicious
- 83b3085fe4f5564efc2159b7276cba851f044851c1e0ef15be66feec7cd1b001 - malicious
- 14a8c155e34417676312c3687eca315c85cfd3f55b31ee441bbcd131cfea0aa5 - malicious
- 0a7dd4fadaacfeac78f0ef88a4f4f172346aad7abb81cc18f91b4ef30002afb9 - malicious
- 6930fdc91be13cdc61ff5f9f625d57cd7965f812d062e8977c38b7e745aa5b82 - malicious
- 7b98560e166b324cb909fa8abef021508277ec4e637f3ec3c4fe93284d808f63 - malicious
Canonical technique definition: MITRE ATT&CK T1105 (ATT&CK v19.1, CC BY 4.0).
Frequently asked about T1105
- How common is ATT&CK T1105 (Ingress Tool Transfer) in real malware?
- ATT&CK technique T1105 Ingress Tool Transfer appears in 9562 publicly analyzed samples on MalwareAnalyzer by Cyble, 9.5% of the analyzed corpus. Seven-day prevalence is rising (4455 recent vs 1566 prior). Most associated families: Mira, Zusy, VJadtre.
- Is T1105 becoming more common?
- Prevalence is rising: 4455 samples in the last seven days against 1566 in the seven days before. This measures submissions to MalwareAnalyzer by Cyble, so it reflects what is being submitted here rather than global attacker behaviour.
- Which malware families use T1105?
- In this corpus T1105 is most associated with Mira (212), Zusy (181), VJadtre (145). Counts are analyzed samples per family in which the technique was observed.
- What share of analyzed samples use T1105?
- 9.5% of the publicly analyzed corpus (9562 of 100953 samples) exhibits T1105. Technique attribution comes from behavior captured during real sandbox detonation and from static analysis, not from a vendor label.
All ATT&CK techniques in the corpus · Latest analyzed threats