ID	B0023
Objective(s)	Execution
Related ATT&CK Techniques	None
Version	2.0
Created	1 August 2019
Last Modified	21 November 2022

Install Additional Program

Installs another, different program on the system. The additional program can be any secondary module; examples include backdoors, malicious drivers, kernel modules, and OS X Apps.

Malware that installs another component is called a "dropper." If the code is contained in the malware, it's a "single stage" dropper; "two stage" droppers download the code from a remote location (the associated download behavior is covered by the Ingress Tool Transfer (E1105) behavior.

Use in Malware

Name	Date	Method	Description
WebCobra	November 2018	--	Drops software to mine for cryptocurrency. [1]
Geneio	August 2015	--	Geneio installs the browser extension ~/Library/Safari/Extensions/Omnibar.safariextz. It also creates app files. [7]
GoBotKR	2019	--	GoBotKR reinstalls its running instance if it is removed. [3]
MazarBot	2016	--	Installs a backdoor. [8]
Mebromi	2011	--	Malware contains a dropper that installs additional programs like Cbrom.exe. [9]
YiSpecter	2015	--	Can download and install arbitrary iOS apps. [10]
CozyCar	2010	--	Upon execution, CozyCar drops a decoy file and a secondary dropper [5]
Clipminer	2011	--	Clipminer drops a file masquerading as a Control Panel (CPL) file [6]
Dark Comet	2008	--	Contain an embedded PE file (This capa rule had 1 match) [11]
Gamut	2014	--	Contain an embedded PE file (This capa rule had 1 match) [11]
Redhip	2011	--	Contain an embedded PE file (This capa rule had 1 match) [11]
SearchAwesome	2018	--	The malware installs an open-source program called mitmproxy. [12]
UP007 Malware Family	2016	--	The malware is a dropper that creates multiple files [4]