Procedure examples

StrelaStealer payloads have tailored filenames to include names identical to the name of the targeted organization or company.

Grandoreiro has named malicious browser extensions and update files to appear legitimate.

Starloader has masqueraded as legitimate software update packages such as Adobe Acrobat Reader and Intel.

Sibot has downloaded a DLL to the C:\windows\system32\drivers\ folder and renamed it with a .sys extension.

Tarrask has masqueraded as executable files such as `winupdate.exe`, `date.exe`, or `win.exe`.

GoBear is installed through droppers masquerading as legitimate, signed software installers.

Shark binaries have been named `audioddg.pdb` and `Winlangdb.pdb` in order to appear legitimate.

The Bazar loader has named malicious shortcuts "adobe" and mimicked communications software.

SUGARDUMP has been named `CrashReporter.exe` to appear as a legitimate Mozilla executable.

Ryuk has constructed legitimate appearing installation folder paths by calling GetWindowsDirectoryW and then inserting a null byte at the fourth character of the path. For Windows Vista or higher, the path would appear as C:\Users\Public.

HermeticWiper has used the name `postgressql.exe` to mask a malicious payload.

Pysa has executed a malicious executable by naming it svchost.exe.

FinFisher renames one of its .dll files to uxtheme.dll in an apparent attempt to masquerade as a legitimate file.

OwaAuth uses the filename owaauth.dll, which is a legitimate file that normally resides in %ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\Auth\; the malicious file by the same name is saved in %ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\bin\.

SUNBURST created VBScripts that were named after existing services or folders to blend into legitimate activities.

REvil can mimic the names of known executables.

Samurai has created the directory `%COMMONPROGRAMFILES%\Microsoft Shared\wmi\` to contain DLLs for loading successive stages.

USBStealer mimics a legitimate Russian program called USB Disk Security.

SUPERNOVA has masqueraded as a legitimate SolarWinds DLL.

Cyclops Blink can rename its running process to [kworker:0/1] to masquerade as a Linux kernel thread. Cyclops Blink has also named RC scripts used for persistence after WatchGuard artifacts.

Daserf uses file and folder names related to legitimate programs in order to blend in, such as HP, Intel, Adobe, and perflogs.

DanBot files have been named `UltraVNC.exe` and `WINVNC.exe` to appear as legitimate VNC tools.

Calisto's installation file is an unsigned DMG image under the guise of Intego’s security solution for mac.

GoldenSpy's setup file installs initial executables under the folder %WinDir%\System32\PluginManager.

Ramsay has masqueraded as a 7zip installer.

AshTag has masqueraded as a legitimate VisualServer utility.

Carberp has masqueraded as Windows system file names, as well as "chkntfs.exe" and "syscron.exe".

SUNSPOT was identified on disk with a filename of taskhostsvc.exe and it created an encrypted log file at C:\Windows\Temp\vmware-vmdmp.log.

OutSteel attempts to download and execute Saint Bot to a statically-defined location attempting to mimic svchost: %TEMP%\\svjhost.exe.

BackConfig has hidden malicious payloads in %USERPROFILE%\Adobe\Driver\dwg\ and mimicked the legitimate DHCP service binary.

PowGoop has used a DLL named Goopdate.dll to impersonate a legitimate Google update file.

LAMEHUG payloads have been disguised with legitimate looking filenames including AI_generator_uncensored_Canvas_PRO_v0.9.exe and AI_image_generator_v0.95.exe.

InnaputRAT variants have attempted to appear legitimate by using the file names SafeApp.exe and NeutralApp.exe.

LookBack has a C2 proxy tool that masquerades as GUP.exe, which is software used by Notepad++.

Penquin has mimicked the Cron binary to hide itself on compromised systems.

A Winnti for Windows implant file was named ASPNET_FILTER.DLL, mimicking the legitimate ASP.NET ISAPI filter DLL with the same name.

Troll Stealer is typically installed via a dropper file that masquerades as a legitimate security program installation file.

ChChes copies itself to an .exe file with a filename that is likely intended to imitate Norton Antivirus but has several letters reversed (e.g. notron.exe).

ANDROMEDA has been installed to `C:\Temp\TrustedInstaller.exe` to mimic a legitimate Windows installer service.

IceApple .NET assemblies have used `App_Web_` in their file names to appear legitimate.

Shai-Hulud has masqueraded as a legitimate Bun installer.

VIRTUALPITA samples have been found in `/usr/libexec/setconf/ksmd` and `/usr/bin/ksmd`, named to spoof the legitimate Kernel Same-Page Merging Daemon binary.

KOCTOPUS has been disguised as legitimate software programs associated with the travel and airline industries.

MechaFlounder has been downloaded as a file named lsass.exe, which matches the legitimate Windows file.

HTTPBrowser's installer contains a malicious file named navlu.dll to decrypt and run the RAT. navlu.dll is also the name of a legitimate Symantec DLL.

Mis-Type saves itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.

Octopus has been disguised as legitimate programs, such as Java and Telegram Messenger.

Qilin has named its payload file TeamViewer_Host_Setup to disguise itself as a legitimate TeamViewer file.

BADNEWS attempts to hide its payloads using legitimate filenames.

Goopy has impersonated the legitimate goopdate.dll, which was dropped on the target system with a legitimate GoogleUpdate.exe.