Procedure examples

SUNSPOT was identified on disk with a filename of taskhostsvc.exe and it created an encrypted log file at C:\Windows\Temp\vmware-vmdmp.log.

OutSteel attempts to download and execute Saint Bot to a statically-defined location attempting to mimic svchost: %TEMP%\\svjhost.exe.

BackConfig has hidden malicious payloads in %USERPROFILE%\Adobe\Driver\dwg\ and mimicked the legitimate DHCP service binary.

PowGoop has used a DLL named Goopdate.dll to impersonate a legitimate Google update file.

LAMEHUG payloads have been disguised with legitimate looking filenames including AI_generator_uncensored_Canvas_PRO_v0.9.exe and AI_image_generator_v0.95.exe.

InnaputRAT variants have attempted to appear legitimate by using the file names SafeApp.exe and NeutralApp.exe.

LookBack has a C2 proxy tool that masquerades as GUP.exe, which is software used by Notepad++.

Penquin has mimicked the Cron binary to hide itself on compromised systems.

A Winnti for Windows implant file was named ASPNET_FILTER.DLL, mimicking the legitimate ASP.NET ISAPI filter DLL with the same name.

Troll Stealer is typically installed via a dropper file that masquerades as a legitimate security program installation file.

ChChes copies itself to an .exe file with a filename that is likely intended to imitate Norton Antivirus but has several letters reversed (e.g. notron.exe).

ANDROMEDA has been installed to `C:\Temp\TrustedInstaller.exe` to mimic a legitimate Windows installer service.

IceApple .NET assemblies have used `App_Web_` in their file names to appear legitimate.

Shai-Hulud has masqueraded as a legitimate Bun installer.

VIRTUALPITA samples have been found in `/usr/libexec/setconf/ksmd` and `/usr/bin/ksmd`, named to spoof the legitimate Kernel Same-Page Merging Daemon binary.

KOCTOPUS has been disguised as legitimate software programs associated with the travel and airline industries.

MechaFlounder has been downloaded as a file named lsass.exe, which matches the legitimate Windows file.

HTTPBrowser's installer contains a malicious file named navlu.dll to decrypt and run the RAT. navlu.dll is also the name of a legitimate Symantec DLL.

Mis-Type saves itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.

Octopus has been disguised as legitimate programs, such as Java and Telegram Messenger.

Qilin has named its payload file TeamViewer_Host_Setup to disguise itself as a legitimate TeamViewer file.

BADNEWS attempts to hide its payloads using legitimate filenames.

Goopy has impersonated the legitimate goopdate.dll, which was dropped on the target system with a legitimate GoogleUpdate.exe.

Gelsemium has named malicious binaries `serv.exe`, `winprint.dll`, and `chrome_elf.dll` and has set its persistence in the Registry with the key value Chrome Update to appear legitimate.

OSX/Shlayer can masquerade as a Flash Player update.

One of Dtrack can hide in replicas of legitimate programs like OllyDbg, 7-Zip, and FileZilla.

StrifeWater has been named `calc.exe` to appear as a legitimate calculator program.

SLOTHFULMEDIA has mimicked the names of known executables, such as mediaplayer.exe.

XORIndex Loader has leveraged legitimate package names to mimic frequently utilized tools to entice victims to download and execute malicious payloads.

Small Sieve can use variations of Microsoft and Outlook spellings, such as "Microsift", in its file names to avoid detection.

HermeticWizard has been named `exec_32.dll` to mimic a legitimate MS Outlook .dll.

ShimRatReporter spoofed itself as AlphaZawgyl_font.exe, a specialized Unicode font.

PcShare has been named `wuauclt.exe` to appear as the legitimate Windows Update AutoUpdate Client.

Brute Ratel C4 has used a payload file named OneDrive.update to appear benign.

MCMD has been named Readme.txt to appear legitimate.

TeamPCP Cloud Stealer has installed a backdoor named sysmon.py on targeted systems.

Mini Shai-Hulud has leveraged a user-agent string that mimics a standard git client to avoid detection within network logs.

CanisterWorm has mimicked legitimate PostgreSQL components (pgmon, pglog, and .pg_state) to masquerade malicious files.

TeamPCP has cloned GitHub commit metadata including the author name, email, committer, and timestamps to use for impostor commits. TeamPCP has also used legitimate file names such as msbuild.exe and ringtone.wav to mask malicious payloads.

ShinyHunters has disguised MeshCentral agent binaries as Microsoft Azure services, e.g. meshagent32-azure-ops.exe, meshagent64-azure-ops.exe, and meshagent64-v2.exe.

APT38 has put several spaces before a file extension to avoid detection and suspicion.

Keydnap puts a space after a false .jpg extension so that execution actually goes through the Terminal.app program.

Kimsuky has used an additional filename extension to hide the true file type. Kimsuky has also masqueraded malicious LNK files as PDF objects using the double extension .pdf.lnk.

Mustang Panda has used an additional filename extension to hide the true file type.

DarkGate masquerades malicious LNK files as PDF objects using the double extension .pdf.lnk.

The Bazar loader has used dual-extension executable files such as PreviewReport.DOC.exe.

Milan has used an executable named `companycatalog.exe.config` to appear benign.

During Operation Dream Job, Lazarus Group disguised malicious template files as JPEG files to avoid detection.

During Operation AkaiRyū, MirrorFace disguised LNK and SFX (self-extracting) files as Word documents to lure victims into opening malicious files.

During the 2016 Ukraine Electric Power Attack, Sandworm Team masqueraded executables as `.txt` files.