Procedure examples

Calisto's installation file is an unsigned DMG image under the guise of Intego’s security solution for mac.

GoldenSpy's setup file installs initial executables under the folder %WinDir%\System32\PluginManager.

Ramsay has masqueraded as a 7zip installer.

AshTag has masqueraded as a legitimate VisualServer utility.

Carberp has masqueraded as Windows system file names, as well as "chkntfs.exe" and "syscron.exe".

SUNSPOT was identified on disk with a filename of taskhostsvc.exe and it created an encrypted log file at C:\Windows\Temp\vmware-vmdmp.log.

OutSteel attempts to download and execute Saint Bot to a statically-defined location attempting to mimic svchost: %TEMP%\\svjhost.exe.

BackConfig has hidden malicious payloads in %USERPROFILE%\Adobe\Driver\dwg\ and mimicked the legitimate DHCP service binary.

PowGoop has used a DLL named Goopdate.dll to impersonate a legitimate Google update file.

LAMEHUG payloads have been disguised with legitimate looking filenames including AI_generator_uncensored_Canvas_PRO_v0.9.exe and AI_image_generator_v0.95.exe.

InnaputRAT variants have attempted to appear legitimate by using the file names SafeApp.exe and NeutralApp.exe.

LookBack has a C2 proxy tool that masquerades as GUP.exe, which is software used by Notepad++.

Penquin has mimicked the Cron binary to hide itself on compromised systems.

A Winnti for Windows implant file was named ASPNET_FILTER.DLL, mimicking the legitimate ASP.NET ISAPI filter DLL with the same name.

Troll Stealer is typically installed via a dropper file that masquerades as a legitimate security program installation file.

ChChes copies itself to an .exe file with a filename that is likely intended to imitate Norton Antivirus but has several letters reversed (e.g. notron.exe).

ANDROMEDA has been installed to `C:\Temp\TrustedInstaller.exe` to mimic a legitimate Windows installer service.

IceApple .NET assemblies have used `App_Web_` in their file names to appear legitimate.

Shai-Hulud has masqueraded as a legitimate Bun installer.

VIRTUALPITA samples have been found in `/usr/libexec/setconf/ksmd` and `/usr/bin/ksmd`, named to spoof the legitimate Kernel Same-Page Merging Daemon binary.

KOCTOPUS has been disguised as legitimate software programs associated with the travel and airline industries.

MechaFlounder has been downloaded as a file named lsass.exe, which matches the legitimate Windows file.

HTTPBrowser's installer contains a malicious file named navlu.dll to decrypt and run the RAT. navlu.dll is also the name of a legitimate Symantec DLL.

Mis-Type saves itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.

Octopus has been disguised as legitimate programs, such as Java and Telegram Messenger.

Qilin has named its payload file TeamViewer_Host_Setup to disguise itself as a legitimate TeamViewer file.

BADNEWS attempts to hide its payloads using legitimate filenames.

Goopy has impersonated the legitimate goopdate.dll, which was dropped on the target system with a legitimate GoogleUpdate.exe.

Gelsemium has named malicious binaries `serv.exe`, `winprint.dll`, and `chrome_elf.dll` and has set its persistence in the Registry with the key value Chrome Update to appear legitimate.

OSX/Shlayer can masquerade as a Flash Player update.

One of Dtrack can hide in replicas of legitimate programs like OllyDbg, 7-Zip, and FileZilla.

StrifeWater has been named `calc.exe` to appear as a legitimate calculator program.

SLOTHFULMEDIA has mimicked the names of known executables, such as mediaplayer.exe.

XORIndex Loader has leveraged legitimate package names to mimic frequently utilized tools to entice victims to download and execute malicious payloads.

Small Sieve can use variations of Microsoft and Outlook spellings, such as "Microsift", in its file names to avoid detection.

HermeticWizard has been named `exec_32.dll` to mimic a legitimate MS Outlook .dll.

ShimRatReporter spoofed itself as AlphaZawgyl_font.exe, a specialized Unicode font.

PcShare has been named `wuauclt.exe` to appear as the legitimate Windows Update AutoUpdate Client.

Brute Ratel C4 has used a payload file named OneDrive.update to appear benign.

MCMD has been named Readme.txt to appear legitimate.

TeamPCP Cloud Stealer has installed a backdoor named sysmon.py on targeted systems.

Mini Shai-Hulud has leveraged a user-agent string that mimics a standard git client to avoid detection within network logs.

CanisterWorm has mimicked legitimate PostgreSQL components (pgmon, pglog, and .pg_state) to masquerade malicious files.