Procedure examples

Sandworm Team has avoided detection by naming a malicious binary explorer.exe.

Machete's Machete MSI installer has masqueraded as a legitimate Adobe Acrobat Reader installer.

Sidewinder has named malicious files rekeywiz.exe to match the name of a legitimate Windows executable.

Mustang Panda has used names like `adobeupdate.dat` and `PotPlayerDB.dat` to disguise PlugX, and a file named `OneDrive.exe` to load a Cobalt Strike payload. Mustang Panda has also masqueraded legitimate browser plugin updates to include AdobePlugins.exe.

Rocke has used shell scripts which download mining executables and saves them with the filename "java".

APT39 has used malware disguised as Mozilla Firefox and a tool named mfevtpse.exe to proxy C2 communications, closely mimicking a legitimate McAfee file mfevtps.exe.

TA2541 has used file names to mimic legitimate Windows files or system functionality.

Akira has used legitimate names and locations for files to evade defenses.

OilRig has named a downloaded copy of the Plink tunneling utility as \ProgramData\Adobe.exe.

Carbanak has named malware "svchost.exe," which is the name of the Windows shared service host program.

Tropic Trooper has hidden payloads in Flash directories and fake installer files.

Aquatic Panda renamed or moved malicious binaries to legitimate locations to evade defenses and blend into victim environments.

Ferocious Kitten has named malicious files update.exe and loaded them into the compromise host's “Public” folder.

Ke3chang has dropped their malware into legitimate installed software paths including: `C:\ProgramFiles\Realtek\Audio\HDA\AERTSr.exe`, `C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitRdr64.exe`, `C:\Program Files (x86)\Adobe\Flash Player\AddIns\airappinstaller\airappinstall.exe`, and `C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd64.exe`.

The file name AcroRD32.exe, a legitimate process name for Adobe's Acrobat Reader, was used by APT1 as a name for malware.

Blue Mockingbird has masqueraded their XMRIG payload name by naming it wercplsupporte.dll after the legitimate wercplsupport.dll file.

Turla has named components of LunarWeb to mimic Zabbix agent logs.

Poseidon Group tools attempt to spoof anti-virus processes as a means of self-defense.

RedCurl mimicked legitimate file names and scheduled tasks, e.g. ` MicrosoftCurrentupdatesCheck` and
`MdMMaintenenceTask` to mask malicious files and scheduled tasks.

APT29 has renamed malicious DLLs with legitimate names to appear benign; they have also created an Azure AD certificate with a Common Name that matched the display name of the compromised service principal.

Chimera has renamed malware to GoogleUpdate.exe and WinRAR to jucheck.exe, RecordedTV.ms, teredo.tmp, update.exe, and msadcs1.exe.

BRONZE BUTLER has given malware the same name as an existing file on the file share server to cause users to unwittingly launch and install the malware on additional systems.

BackdoorDiplomacy has dropped implants in folders named for legitimate software.

Darkhotel has used malware that is disguised as a Secure Shell (SSH) tool.

Ember Bear has renamed tools to match legitimate utilities, such as renaming GOST tunneling instances to `java` in victim environments.

ToddyCat has used the name `debug.exe` for malware components.

Whitefly has named the malicious DLL the same name as DLLs belonging to legitimate software from various security vendors.

LuminousMoth has disguised their exfiltration malware as `ZoomVideoApp.exe`.

APT28 has changed extensions on files containing exfiltrated data to make them appear benign, and renamed a web shell instance to appear as a legitimate OWA page.

APT42 has masqueraded the VINETHORN payload as a VPN application.

APT5 has named exfiltration archives to mimic Windows Updates at times using filenames with a `KB<digits>.zip` pattern.

Fox Kitten has named binaries and configuration files svhost and dllhost respectively to appear legitimate.

APT-C-36 has disguised malicious executables to appear as legitimate files.

Lazarus Group has renamed malicious code to disguise it as Microsoft's narrator and other legitimate files.

INC Ransom has named a PsExec executable winupd to mimic a legitimate Windows update file.

Earth Lusca used the command `move [file path] c:\windows\system32\spool\prtprocs\x64\spool.dll` to move and register a malicious DLL name as a Windows print processor, which eventually was loaded by the Print Spooler service.

Silence has named its backdoor "WINWORD.exe".

Sowbug named its tools to masquerade as Windows or Adobe Reader software, such as by using the file name adobecms.exe and the directory CSIDL_APPDATA\microsoft\security.

Velvet Ant used a malicious DLL, `iviewers.dll`, that mimics the legitimate "OLE/COM Object Viewer" within Windows.

Transparent Tribe can mimic legitimate Windows directories by using the same icons and names.

VOID MANTICORE has masqueraded malicious payloads to resemble legitimate applications. VOID MANTICORE has leveraged malicious payloads that use nomenclature associated with common applications that include Pictory, KeePass, WhatsApp, and Telegram.

PROMETHIUM has disguised malicious installer files by bundling them with legitimate software installers.

WIRTE has used security service provider naming conventions such as ESET and Kasperky ("Kaspersky Update Agent") in order to appear legitimate.

Magic Hound has used `dllhost.exe` to mask Fast Reverse Proxy (FRP) and `MicrosoftOutLookUpdater.exe` for Plink.

FIN13 has masqueraded WAR files to look like legitimate packages such as, wsexample.war, wsexamples.com, examples.war, and exampl3s.war.

EKANS has been disguised as update.exe to appear as a valid executable.

BLINDINGCAN has attempted to hide its payload by using legitimate file names such as "iconcache.db".

Ninja has used legitimate looking filenames for its loader including update.dll and x64.dll.

Bumblebee has named component DLLs "RapportGP.dll" to match those used by the security company Trusteer.

BRICKSTORM has appeared to resemble legitimate processes to include the vCenter process `vami-http`. BRICKSTORM has also leveraged legitimate names of VMware vSphere platform such as `vmsrc` or `vmware-sphere`.