Procedure examples

Machete renamed payloads to masquerade as legitimate Google Chrome, Java, Dropbox, Adobe Reader and Python executables.

DUSTPAN is often disguised as a legitimate Windows binary such as `w3wp.exe` or `conn.exe`.

PUBLOAD has renamed malicious files to mimic legitimate file names such as adobe_wf.exe.

CANONSTAGER has leveraged naming conventions of its malicious DLL to match legitimate services to include cnmpaui.dll which matches the legitimate executable cnmpaui.exe that is aligned with a Canon Ink Jet Printer Assistant Tool.

HexEval Loader has masqueraded and typosquatted as legitimate code repository packages and projects.

Cuckoo Stealer has copied and renamed itself to DumpMediaSpotifyMusicConverter.

InvisiMole has disguised its droppers as legitimate software or documents, matching their original names and locations, and saved its files as mpr.dll in the Windows folder.

CLAIMLOADER has imitated legitimate software directories through the creation and storage of the EXE and DLL in `C:\ProgramData\` and the use of legitimate looking names of software.

QUIETEXIT has attempted to change its name to `cron` upon startup. During incident response, QUIETEXIT samples have been identified that were renamed to blend in with other legitimate files.

RDAT has masqueraded as VMware.exe.

Skidmap has created a fake rm binary to replace the legitimate Linux binary.

TRANSLATEXT has been named `GoogleTranslate.crx` to masquerade as a legitimate Chrome extension.

SameCoin has named files to appear legitimate such as "MicrosoftEdge.exe."

Raindrop was installed under names that resembled legitimate Windows file and directory names.

Doki has disguised a file as a Linux kernel module.

RustyWater has used reddit.exe as its file name and a Cloudflare logo.

Fysbis has masqueraded as trusted software rsyncd and dbus-inotifier.

IcedID has modified legitimate .dll files to include malicious code.

MarkiRAT can masquerade as update.exe and svehost.exe; it has also mimicked legitimate Telegram and Chrome files.

DarkComet has dropped itself onto victim machines with file names such as WinDefender.Exe and winupdate.exe in an apparent attempt to masquerade as a legitimate file.

DRATzarus has been named `Flash.exe`, and its dropper has been named `IExplorer`.

SocGholish has been named `AutoUpdater.js` to mimic legitimate update files.

Green Lambert has been disguised as a Growl help file.

PUNCHBUGGY mimics filenames from %SYSTEM%\System32 to hide DLLs in %WINDIR% and/or %TEMP%.

GoldMax has used filenames that matched the system name, and appeared as a scheduled task impersonating systems management software within the corresponding ProgramData subfolder.

PlugX has been disguised as legitimate Adobe and PotPlayer files. PlugX has also imitated legitimate software directories and file names through the creation and storage of a legitimate EXE and the malicious DLLs.

Bisonal has renamed malicious code to `msacm32.dll` to hide within a legitimate library; earlier versions were disguised as `winhelp`.

S-Type may save itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.

The Remsec loader implements itself with the name Security Support Provider, a legitimate Windows function. Various Remsec .exe files mimic legitimate file names used by Microsoft, Symantec, Kaspersky, Hewlett-Packard, and VMWare. Remsec also disguised malicious modules using similar filenames as custom network encryption software on victims.

LightNeuron has used filenames associated with Exchange and Outlook for binary and configuration files, such as winmail.dat.

Cuba has been disguised as legitimate 360 Total Security Antivirus and OpenVPN programs.

PureCrypter has used multiple file names to appear legitimate such as firefox\firefox.exe, Google\chrome.exe, and Taskmgr.exe.

ThiefQuest prepends a copy of itself to the beginning of an executable file while maintaining the name of the executable.

FoggyWeb can be disguised as a Visual Studio file such as `Windows.Data.TimeZones.zh-PH.pri` to evade detection. Also, FoggyWeb's loader can mimic a genuine `dll` file that carries out the same import functions as the legitimate Windows `version.dll` file.

If installing itself as a service fails, Elise instead writes itself as a file named svchost.exe saved in %APPDATA%\Microsoft\Network.

Latrodectus has been packed to appear as a component to Bitdefender’s kernel-mode driver, TRUFOS.SYS.

Saint Bot has been disguised as a legitimate executable, including as Windows SDK.

Chaes has used an unsigned, crafted DLL module named hha.dll that was designed to look like a legitimate 32-bit Windows DLL.

Bundlore has disguised a malicious .app file as a Flash Player update.

Fooder has frequently masqueraded as the Snake game, using strings such as “Welcome to snake Game” and mutexes such as “SNAKE_G.”

QUADAGENT used the PowerShell filenames Office365DCOMCheck.ps1 and SystemDiskClean.ps1.

The TAINTEDSCRIBE main executable has disguised itself as Microsoft’s Narrator.

Metamorfo has disguised an MSI file as the Adobe Acrobat Reader Installer and has masqueraded payloads as OneDrive, WhatsApp, or Spotify, for example.

PipeMon modules are stored on disk with seemingly benign names including use of a file extension associated with a popular word processor.

MagicRAT stores configuration data in files and file paths mimicking legitimate operating system resources.

KONNI has created a shortcut called "Anti virus service.lnk" in an apparent attempt to masquerade as a legitimate file.

KGH_SPY has masqueraded as a legitimate Windows tool.

Ixeshe has used registry values and file names associated with Adobe software, such as AcroRd32.exe.

The Black Basta dropper has mimicked an application for creating USB bootable drivers.

NightClub has chosen file names to appear legitimate including EsetUpdate-0117583943.exe for its dropper.