Procedure examples

Gelsemium has named malicious binaries `serv.exe`, `winprint.dll`, and `chrome_elf.dll` and has set its persistence in the Registry with the key value Chrome Update to appear legitimate.

OSX/Shlayer can masquerade as a Flash Player update.

One of Dtrack can hide in replicas of legitimate programs like OllyDbg, 7-Zip, and FileZilla.

StrifeWater has been named `calc.exe` to appear as a legitimate calculator program.

SLOTHFULMEDIA has mimicked the names of known executables, such as mediaplayer.exe.

XORIndex Loader has leveraged legitimate package names to mimic frequently utilized tools to entice victims to download and execute malicious payloads.

Small Sieve can use variations of Microsoft and Outlook spellings, such as "Microsift", in its file names to avoid detection.

HermeticWizard has been named `exec_32.dll` to mimic a legitimate MS Outlook .dll.

ShimRatReporter spoofed itself as AlphaZawgyl_font.exe, a specialized Unicode font.

PcShare has been named `wuauclt.exe` to appear as the legitimate Windows Update AutoUpdate Client.

Brute Ratel C4 has used a payload file named OneDrive.update to appear benign.

MCMD has been named Readme.txt to appear legitimate.

TeamPCP Cloud Stealer has installed a backdoor named sysmon.py on targeted systems.

Mini Shai-Hulud has leveraged a user-agent string that mimics a standard git client to avoid detection within network logs.

CanisterWorm has mimicked legitimate PostgreSQL components (pgmon, pglog, and .pg_state) to masquerade malicious files.

Keydnap puts a space after a false .jpg extension so that execution actually goes through the Terminal.app program.

DarkGate masquerades malicious LNK files as PDF objects using the double extension .pdf.lnk.

The Bazar loader has used dual-extension executable files such as PreviewReport.DOC.exe.

Milan has used an executable named `companycatalog.exe.config` to appear benign.

AvosLocker has been disguised as a .jpg file.

HeartCrypt can append a BMP header to encoded malicious payloads to masquerade them as BMP files.

STATICPLUGIN has masqueraded as a BMP file to hide its true MSI file extension.

Raspberry Robin has historically been delivered via infected USB drives containing a malicious LNK object masquerading as a legitimate folder.

Lumma Stealer has used payloads that resemble benign file extensions such as .mp3, .accdb, and .pub, though the files contained malicious JavaScript content.

PureCrypter has used a .NET downloader named 63342221.BAT and has used .jpg, .png, and .log as false extensions for malicious files.

MagicRAT can download additional executable payloads that masquerade as GIF files.

StrelaStealer has been distributed as a DLL/HTML polyglot file.

Kapeka masquerades as a Microsoft Word Add-In file, with the extension `.wll`, but is a malicious DLL file.

OSX_OCEANLOTUS.D has disguised it's true file structure as an application bundle by adding special characters to the filename and using the icon for legitimate Word documents.

ANDROMEDA has been delivered through a LNK file disguised as a folder.

The QakBot payload has been disguised as a PNG file and hidden within LNK files using a Microsoft File Explorer icon.

Brute Ratel C4 has used Microsoft Word icons to hide malicious LNK files.

After initial execution, BPFDoor forks itself and runs the fork with the `--init` flag, which allows it to execute secondary clean up operations. The parent process terminates leaving the forked process to be inherited by the legitimate process init.

Shai-Hulud has augmented its installation process by having its original install process exit cleanly to provide the user with the illusion that the service is installed normally.

ServHelper has created a new user named `supportaccount`.

Flame can create backdoor accounts with login `HelpAssistant` on domain connected systems if appropriate rights are available.

BPFDoor overwrites the `argv[0]` value used by the Linux `/proc` filesystem to determine the command line and command name to display for each process. BPFDoor selects a name from 10 hardcoded names that resemble Linux system daemons, such as; `/sbin/udevd -d`, `dbus-daemon --system`, `avahi-daemon: chroot helper`, `/sbin/auditd -n`, and `/usr/lib/systemd/systemd-journald`.

FatDuke has attempted to mimic a compromised user's traffic by using the same user agent as the installed browser.

Depending on the Linux distribution and when executing with root permissions, RotaJakiro may install persistence using a `.conf` file in the `/etc/init/` folder.

SPAWNCHIMERA has modified the boot process files within `/tmp/coreboot_fs/bin/init` to establish persistence.

VIRTUALPITA can persist as an init.d startup service on Linux vCenter systems.

JHUHUGIT has registered a Windows shell script under the Registry key HKCU\Environment\UserInitMprLogonScript to establish persistence.

KGH_SPY has the ability to set the HKCU\Environment\UserInitMprLogonScript Registry key to execute logon scripts.

Attor's dispatcher can establish persistence via adding a Registry key with a logon script HKEY_CURRENT_USER\Environment "UserInitMprLogonScript" .

Zebrocy performs persistence with a logon script via adding to the Registry key HKCU\Environment\UserInitMprLogonScript.

iKitten adds an entry to the rc.common file for persistence.

Green Lambert can add init.d and rc.d files in the /etc folder to establish persistence.

Cyclops Blink has the ability to execute on device startup, using a modified RC script named S51armled.

HiddenWasp installs reboot persistence by adding itself to /etc/rc.local.

jRAT can list and manage startup entries.