T1105 Ingress Tool Transfer in real malware
ATT&CK technique T1105 Ingress Tool Transfer appears in 12136 publicly analyzed samples on MalwareAnalyzer by Cyble, 10.2% of the analyzed corpus. Seven-day prevalence is rising (2 recent vs 0 prior). Most associated families: Zusy, Mira, HUILoader.
Tactics: command-and-control
Prevalence in the corpus
- Samples exhibiting T1105: 12136
- Share of analyzed corpus: 10.2%
- Last 7 days: 2 · prior 7 days: 0 (rising)
Malware families using T1105
Example samples
- 73a753ab526dde6bc6e995259f3655d1884b676e1fa9b516a4497c7accd5461a.bin - suspicious
- 7b8cd695424f9b004b459ce886d92e9a24f38957dc9071510ab669a7cb89c417.bin - malicious
- f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa.bin - malicious
- d37274446823636d119ef458e2b72f1c93524ccd2474b5efc71c67df712789a1.bin - malicious
- 7b1cbba56bb80e185cdf2097f5716c31d7e0f88f28ad7220b3b5a2cf73859ec8.bin - malicious
- e643da_509b9d5743384aed81412efbeff14d8d.pdf - malicious
- givubogop.pdf - suspicious
- 314c35_f0e1a2e26ed74479b65a33525c2a5b16.pdf - suspicious
- dad7b5_11fab4b909c843efad8bf4de5f16b8a1.pdf - malicious
- 227d0f_9b1a54a93aa742bcb539dba9c9607cd1.pdf - suspicious
- 11299162973.pdf - malicious
- 7f614e_e042e76ac4a94ab1896f4ca0c74bd62d.pdf - suspicious
- 93c935_b1637edb771b4417a43cee805fda4e72.pdf - suspicious
- 8da65f_a918376ebd76492e836dfaa1695774f2.pdf - malicious
- 38062a_a0cabceb7cda424dbac7812d344edb4a.pdf - suspicious
- 3d514e_3ae72a779a264acbac3d114ab4c90e4c.pdf - suspicious
- d2751c_25840aff35cc47e29b9200be35965a5a.pdf - suspicious
- 3be48b_dc929480c87a4ea1aa0237eea6cef4cf.pdf - suspicious
- 70766967814.pdf - suspicious
- f35da0_be2b66c44be34bb0843205608c9c0f2d.pdf - suspicious
- 8bf3fc_cd66aef69b4c476a81371651f073792a.pdf - suspicious
- e3325f_e41d9d393955474d8f4f0b8767b03686.pdf - suspicious
- 93c935_018a8668c6b84eb8ba18d85885283fe6.pdf - suspicious
- 3be48b_83dcf4891474473fab6dc5d43041a0d6.pdf - suspicious
- 6cf392_3eaf847de44e42098020310e537a5d2f.pdf - suspicious
Canonical technique definition: MITRE ATT&CK T1105 (ATT&CK v19.1, CC BY 4.0).
Frequently asked about T1105
- How common is ATT&CK T1105 (Ingress Tool Transfer) in real malware?
- ATT&CK technique T1105 Ingress Tool Transfer appears in 12136 publicly analyzed samples on MalwareAnalyzer by Cyble, 10.2% of the analyzed corpus. Seven-day prevalence is rising (2 recent vs 0 prior). Most associated families: Zusy, Mira, HUILoader.
- Is T1105 becoming more common?
- Prevalence is rising: 2 samples in the last seven days against 0 in the seven days before. This measures submissions to MalwareAnalyzer by Cyble, so it reflects what is being submitted here rather than global attacker behaviour.
- Which malware families use T1105?
- In this corpus T1105 is most associated with Zusy (218), Mira (213), HUILoader (186). Counts are analyzed samples per family in which the technique was observed.
- What share of analyzed samples use T1105?
- 10.2% of the publicly analyzed corpus (12136 of 119218 samples) exhibits T1105. Technique attribution comes from behavior captured during real sandbox detonation and from static analysis, not from a vendor label.
All ATT&CK techniques in the corpus · Latest analyzed threats