Procedure examples

Ferocious Kitten has used right-to-left override to reverse executables’ names to make them appear to have different file extensions, rather than their real ones.

Ke3chang has used the right-to-left override character in spearphishing attachment names to trick targets into executing .scr and .exe files.

BlackTech has used right-to-left-override to obfuscate the filenames of malicious e-mail attachments.

BRONZE BUTLER has used Right-to-Left Override to deceive victims into executing several strains of malware.

Scarlet Mimic has used the left-to-right override character in self-extracting RAR archive spearphishing attachment file names.

APT38 has renamed system utilities, such as `rundll32.exe` and `mshta.exe`, to avoid detection.

GALLIUM used a renamed cmd.exe file to evade detection.

menuPass has renamed certutil and moved it to a different location on the system to avoid detection based on use of the tool.

APT32 has moved and renamed pubprn.vbs to a .txt file to avoid detection.

Lazarus Group has renamed system utilities such as wscript.exe and mshta.exe.

Daggerfly used a renamed version of rundll32.exe, such as "dbengin.exe" located in the `ProgramData\Microsoft\PlayReady` directory, to proxy malicious DLL execution.

Kimsuky has disguised services to appear as benign software or related to operating system functions.

APT41 has created services to appear as benign system tools.

APT32 has used hidden or non-printing characters to help masquerade service names, such as appending a Unicode no-break space character to a legitimate service name. APT32 has also impersonated the legitimate Flash installer file name "install_flashplayer.exe".

Naikon renamed a malicious service taskmgr to appear to be a legitimate version of Task Manager.

FIN6 has renamed the "psexec" service name to "mstdc" to masquerade as a legitimate Windows service.

FIN7 has created a scheduled task named “AdobeFlashSync” to establish persistence.

ZIRCONIUM has created a run key named Dropbox Update Setup to mask a persistence mechanism for a malicious binary.

UNC3886 has named a file ‘fgfm’ in an attempt to disguise it as the legitimate service ‘fgfmd’ which facilitates communication between FortiManager and the FortiGate firewall.

Higaisa named a shellcode loader binary svchast.exe to spoof the legitimate svchost.exe.

Carbanak has copied legitimate service names to use for malicious services.

Aquatic Panda created new, malicious services using names such as Windows User Service to attempt to blend in with legitimate items on victim systems.

Winter Vivern has distributed malicious scripts and executables mimicking virus scanners.

Storm-0501 has utilized Rclone masqueraded as svhost.exe and scvhost.exe.

BITTER has disguised malware as a Windows Security update service.

BackdoorDiplomacy has disguised their backdoor droppers with naming conventions designed to blend into normal operations.

Fox Kitten has named the task for a reverse proxy lpupdate to appear legitimate.

APT-C-36 has disguised its scheduled tasks as those used by Google.

Lazarus Group has used a scheduled task named `SRCheck` to mask the execution of a malicious .dll.

Wizard Spider has used scheduled tasks to install TrickBot, using task names to appear legitimate such as WinDotNet, GoogleTask, or Sysnetsf. It has also used common document file names for other malware binaries.

VOID MANTICORE has masqueraded as commonly used programs and services on Windows hosts.

PROMETHIUM has named services to appear legitimate.

Magic Hound has named a malicious script CacheTask.bat to mimic a legitimate task.

FIN13 has used scheduled tasks names such as `acrotyr` and `AppServicesr` to mimic the same names in a compromised network's `C:\Windows` directory.

Indrik Spider used fake updates for FlashPlayer plugin and Google Chrome as initial infection vectors.

SideCopy has used a legitimate DLL file name, `Duser.dll` to disguise a malicious remote access tool.

Mustard Tempest has used the filename `AutoUpdater.js` to mimic legitimate update files and has also used the Cyrillic homoglyph characters С `(0xd0a1)` and а `(0xd0b0)`, to produce the filename `Сhrome.Updаte.zip`.

Kimsuky has renamed malware to legitimate names such as ESTCommon.dll or patch.dll. Kimsuky has also disguised payloads using legitimate file names including a PowerShell payload named chrome.ps1. Kimsuky has also used a malicious QR code that masqueraded as a legitimate package delivery service.

admin@338 actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe

Volt Typhoon has used legitimate looking filenames for compressed copies of the ntds.dit database and used names including cisco_up.exe, cl64.exe, vm3dservice.exe, watchdogd.exe, Win.exe, WmiPreSV.exe, and WmiPrvSE.exe for the Earthworm and Fast Reverse Proxy tools.

Patchwork installed its payload in the startup programs folder as "Baidu Software Update." The group also adds its second stage payload to the startup programs as “Net Monitor." They have also dropped QuasarRAT binaries as files named microsoft_network.exe and crome.exe.

APT41 attempted to masquerade their files as popular anti-virus software.

menuPass has been seen changing malicious files to appear legitimate.

APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update. APT32 has also renamed a Cobalt Strike beacon payload to install_flashplayers.exe.

MuddyWater has disguised malicious executables and used filenames and Registry key names associated with Windows Defender.

Naikon has disguised malicious programs as Google Chrome, Adobe, and VMware executables.

Gamaredon Group has used legitimate process names to hide malware including svchosst. Additionally, Gamaredon Group disguised malicious ZIP archives as Office documents that are related to the invasion.

Storm-1811 has disguised Cobalt Strike installers as a malicious DLL masquerading as part of a legitimate 7zip installation package.

TeamTNT has replaced .dockerd and .dockerenv with their own scripts and cryptocurrency mining software.

FIN7 has attempted to run Darkside ransomware with the filename sleep.exe. Additionally, FIN7 has mimicked WsTaskLoad.exe, which is associated with the Wondershare software suite, by using a malicious executable under the same name.