Procedure examples

Indrik Spider used fake updates for FlashPlayer plugin and Google Chrome as initial infection vectors.

SideCopy has used a legitimate DLL file name, `Duser.dll` to disguise a malicious remote access tool.

Mustard Tempest has used the filename `AutoUpdater.js` to mimic legitimate update files and has also used the Cyrillic homoglyph characters С `(0xd0a1)` and а `(0xd0b0)`, to produce the filename `Сhrome.Updаte.zip`.

Kimsuky has renamed malware to legitimate names such as ESTCommon.dll or patch.dll. Kimsuky has also disguised payloads using legitimate file names including a PowerShell payload named chrome.ps1. Kimsuky has also used a malicious QR code that masqueraded as a legitimate package delivery service.

admin@338 actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe

Volt Typhoon has used legitimate looking filenames for compressed copies of the ntds.dit database and used names including cisco_up.exe, cl64.exe, vm3dservice.exe, watchdogd.exe, Win.exe, WmiPreSV.exe, and WmiPrvSE.exe for the Earthworm and Fast Reverse Proxy tools.

Patchwork installed its payload in the startup programs folder as "Baidu Software Update." The group also adds its second stage payload to the startup programs as “Net Monitor." They have also dropped QuasarRAT binaries as files named microsoft_network.exe and crome.exe.

APT41 attempted to masquerade their files as popular anti-virus software.

menuPass has been seen changing malicious files to appear legitimate.

APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update. APT32 has also renamed a Cobalt Strike beacon payload to install_flashplayers.exe.

MuddyWater has disguised malicious executables and used filenames and Registry key names associated with Windows Defender.

Naikon has disguised malicious programs as Google Chrome, Adobe, and VMware executables.

Gamaredon Group has used legitimate process names to hide malware including svchosst. Additionally, Gamaredon Group disguised malicious ZIP archives as Office documents that are related to the invasion.

Storm-1811 has disguised Cobalt Strike installers as a malicious DLL masquerading as part of a legitimate 7zip installation package.

TeamTNT has replaced .dockerd and .dockerenv with their own scripts and cryptocurrency mining software.

FIN7 has attempted to run Darkside ransomware with the filename sleep.exe. Additionally, FIN7 has mimicked WsTaskLoad.exe, which is associated with the Wondershare software suite, by using a malicious executable under the same name.

Sandworm Team has avoided detection by naming a malicious binary explorer.exe.

Machete's Machete MSI installer has masqueraded as a legitimate Adobe Acrobat Reader installer.

Sidewinder has named malicious files rekeywiz.exe to match the name of a legitimate Windows executable.

Mustang Panda has used names like `adobeupdate.dat` and `PotPlayerDB.dat` to disguise PlugX, and a file named `OneDrive.exe` to load a Cobalt Strike payload. Mustang Panda has also masqueraded legitimate browser plugin updates to include AdobePlugins.exe.

Rocke has used shell scripts which download mining executables and saves them with the filename "java".

APT39 has used malware disguised as Mozilla Firefox and a tool named mfevtpse.exe to proxy C2 communications, closely mimicking a legitimate McAfee file mfevtps.exe.

TA2541 has used file names to mimic legitimate Windows files or system functionality.

Akira has used legitimate names and locations for files to evade defenses.

OilRig has named a downloaded copy of the Plink tunneling utility as \ProgramData\Adobe.exe.

Carbanak has named malware "svchost.exe," which is the name of the Windows shared service host program.

Tropic Trooper has hidden payloads in Flash directories and fake installer files.

Aquatic Panda renamed or moved malicious binaries to legitimate locations to evade defenses and blend into victim environments.

Ferocious Kitten has named malicious files update.exe and loaded them into the compromise host's “Public” folder.

Ke3chang has dropped their malware into legitimate installed software paths including: `C:\ProgramFiles\Realtek\Audio\HDA\AERTSr.exe`, `C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitRdr64.exe`, `C:\Program Files (x86)\Adobe\Flash Player\AddIns\airappinstaller\airappinstall.exe`, and `C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd64.exe`.

The file name AcroRD32.exe, a legitimate process name for Adobe's Acrobat Reader, was used by APT1 as a name for malware.

Blue Mockingbird has masqueraded their XMRIG payload name by naming it wercplsupporte.dll after the legitimate wercplsupport.dll file.

Turla has named components of LunarWeb to mimic Zabbix agent logs.

Poseidon Group tools attempt to spoof anti-virus processes as a means of self-defense.

RedCurl mimicked legitimate file names and scheduled tasks, e.g. ` MicrosoftCurrentupdatesCheck` and
`MdMMaintenenceTask` to mask malicious files and scheduled tasks.

APT29 has renamed malicious DLLs with legitimate names to appear benign; they have also created an Azure AD certificate with a Common Name that matched the display name of the compromised service principal.

Chimera has renamed malware to GoogleUpdate.exe and WinRAR to jucheck.exe, RecordedTV.ms, teredo.tmp, update.exe, and msadcs1.exe.

BRONZE BUTLER has given malware the same name as an existing file on the file share server to cause users to unwittingly launch and install the malware on additional systems.

BackdoorDiplomacy has dropped implants in folders named for legitimate software.

Darkhotel has used malware that is disguised as a Secure Shell (SSH) tool.

Ember Bear has renamed tools to match legitimate utilities, such as renaming GOST tunneling instances to `java` in victim environments.

ToddyCat has used the name `debug.exe` for malware components.

Whitefly has named the malicious DLL the same name as DLLs belonging to legitimate software from various security vendors.

LuminousMoth has disguised their exfiltration malware as `ZoomVideoApp.exe`.

APT28 has changed extensions on files containing exfiltrated data to make them appear benign, and renamed a web shell instance to appear as a legitimate OWA page.

APT42 has masqueraded the VINETHORN payload as a VPN application.

APT5 has named exfiltration archives to mimic Windows Updates at times using filenames with a `KB<digits>.zip` pattern.

Fox Kitten has named binaries and configuration files svhost and dllhost respectively to appear legitimate.

APT-C-36 has disguised malicious executables to appear as legitimate files.

Lazarus Group has renamed malicious code to disguise it as Microsoft's narrator and other legitimate files.