File Download - How Does it Work?

[burt-mianus]

Hello, I am using Sliver to emulate C2 behaviour in my lab, and when doing firewall inspection I see file downloads appearing as transfers of .api files (i think). It almost looks like the is broken down into smaller chunks and packaged as these benign php files and transferred to the server.

(apologies for the crude terminology....)

Would appreciate some help understanding the behaviour.

Thanks

[moloch--]

This document describes the process:
https://sliver.sh/docs?name=HTTPS+C2#under-the-hood