Procedure examples

OSX_OCEANLOTUS.D uses file naming conventions with associated executable locations to blend in with the macOS TimeMachine and OpenSSL services. Such as, naming a LaunchAgent plist file `com.apple.openssl.plist` which executes OSX_OCEANLOTUS.D from the user's `~/Library/OpenSSL/` folder upon user login.

Seasalt has masqueraded as a service called "SaSaut" with a display name of "System Authorization Service" in an apparent attempt to masquerade as a legitimate service.

FunnyDream has used a service named `WSearch` for execution.

SysUpdate has named their unit configuration file similarly to other unit files residing in the same directory, `/usr/lib/systemd/system/`, to appear benign.

Kwampirs establishes persistence by adding a new service with the display name "WMI Performance Adapter Extension" in an attempt to masquerade as a legitimate WMI service.

DEADEYE has used `schtasks /change` to modify scheduled tasks including `\Microsoft\Windows\PLA\Server Manager Performance Monitor`, `\Microsoft\Windows\Ras\ManagerMobility, \Microsoft\Windows\WDI\SrvSetupResults`, and `\Microsoft\Windows\WDI\USOShared`.

InnaputRAT variants have attempted to appear legitimate by adding a new service named OfficeUpdateService.

Egregor has masqueraded the svchost.exe process to exfiltrate data.

build_downer has added itself to the Registry Run key as "NVIDIA" to appear legitimate.

Meteor has been disguised as the Windows Power Efficiency Diagnostics report tool.

Maze operators have created scheduled tasks masquerading as "Windows Update Security", "Windows Update Security Patches", and "Google Chrome Security Update" designed to launch the ransomware.

ComRAT has used a task name associated with Windows SQM Consolidator.

VIRTUALPITA has utilized VMware service names and ports to masquerade as legitimate services.

Heyoka Backdoor has been named `srvdll.dll` to appear as a legitimate service.

KillDisk registers as a service under the Plug-And-Play Support name.

Qilin has created a scheduled task named TVInstallRestore to mimic TeamViewer.

POWERSTATS has created a scheduled task named "MicrosoftEdge" to establish persistence.

DEADWOOD will attempt to masquerade its service execution using benign-looking names such as ScDeviceEnums.

SLOTHFULMEDIA has named a service it establishes on victim machines as "TaskFrame" to hide its malicious purpose.

CSPY Downloader has attempted to appear as a legitimate Windows service with a fake description claiming it is used to support packed applications.

IronNetInjector has been disguised as a legitimate service using the name PythonUpdateSrvc.

CanisterWorm has masqueraded itself as systemd or as a PostgreSQL utility named pgmon.

EKANS has been disguised as update.exe to appear as a valid executable.

BLINDINGCAN has attempted to hide its payload by using legitimate file names such as "iconcache.db".

Ninja has used legitimate looking filenames for its loader including update.dll and x64.dll.

Bumblebee has named component DLLs "RapportGP.dll" to match those used by the security company Trusteer.

BRICKSTORM has appeared to resemble legitimate processes to include the vCenter process `vami-http`. BRICKSTORM has also leveraged legitimate names of VMware vSphere platform such as `vmsrc` or `vmware-sphere`.

NOKKI is written to %LOCALAPPDATA%\MicroSoft Updatea\svServiceUpdate.exe prior being executed in a new process in an apparent attempt to masquerade as a legitimate folder and file.

RotaJakiro has used the filename `systemd-daemon` in an attempt to appear legitimate.

Chinoxy has used the name `eoffice.exe` in attempt to appear as a legitimate file.

Misdat saves itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.

Ursnif has used strings from legitimate system files and existing folders for its file, folder, and Registry entry names.

ThreatNeedle chooses its payload creation path from a randomly selected service name from netsvc.

ZLib mimics the resource version information of legitimate Realtek Semiconductor, Nvidia, or Synaptics modules.

Tsundere Botnet has disguised its MSI installer as a fake installer for popular games and software.

Felismus has masqueraded as legitimate Adobe Content Management System files.

StrongPity has been bundled with legitimate software installation files for disguise.

Nebulae uses functions named StartUserModeBrowserInjection and StopUserModeBrowserInjection indicating that it's trying to imitate chrome_frame_helper.dll.

TONESHELL has renamed malicious files to mimic legitimate file names and file extensions. TONESHELL has also masqueraded as legitimate file names to include LogMeIn.dll.

RainyDay has used names to mimic legitimate software including "vmtoolsd.exe" to spoof Vmtools.

AppleSeed has the ability to rename its payload to ESTCommon.dll to masquerade as a DLL belonging to ESTsecurity.

NETWIRE has masqueraded as legitimate software including TeamViewer and macOS Finder.

TinyTurla has been deployed as `w64time.dll` to appear legitimate.

PyDCrypt has dropped DCSrv under the `svchost.exe` name to disk.

J-magic can rename itself as “[nfsiod 0]” to masquerade as the local Network File System (NFS) asynchronous I/O server.

OLDBAIT installs itself in %ALLUSERPROFILE%\\Application Data\Microsoft\MediaPlayer\updatewindws.exe; the directory name is missing a space and the file name is missing the letter "o."

Bad Rabbit has masqueraded as a Flash Player installer through the executable file install_flash_player.exe.

To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start,” “Yahoo Talk,” “MSN Gaming Z0ne,” or “MSN Talk” shortcut.

STATICPLUGIN has leveraged naming conventions that match legitimate services to include AdobePlugins.exe.

TEARDROP files had names that resembled legitimate Window file and directory names.