Procedure examples

EKANS has been disguised as update.exe to appear as a valid executable.

BLINDINGCAN has attempted to hide its payload by using legitimate file names such as "iconcache.db".

Ninja has used legitimate looking filenames for its loader including update.dll and x64.dll.

Bumblebee has named component DLLs "RapportGP.dll" to match those used by the security company Trusteer.

BRICKSTORM has appeared to resemble legitimate processes to include the vCenter process `vami-http`. BRICKSTORM has also leveraged legitimate names of VMware vSphere platform such as `vmsrc` or `vmware-sphere`.

NOKKI is written to %LOCALAPPDATA%\MicroSoft Updatea\svServiceUpdate.exe prior being executed in a new process in an apparent attempt to masquerade as a legitimate folder and file.

RotaJakiro has used the filename `systemd-daemon` in an attempt to appear legitimate.

Chinoxy has used the name `eoffice.exe` in attempt to appear as a legitimate file.

Misdat saves itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.

Ursnif has used strings from legitimate system files and existing folders for its file, folder, and Registry entry names.

ThreatNeedle chooses its payload creation path from a randomly selected service name from netsvc.

ZLib mimics the resource version information of legitimate Realtek Semiconductor, Nvidia, or Synaptics modules.

Tsundere Botnet has disguised its MSI installer as a fake installer for popular games and software.

Felismus has masqueraded as legitimate Adobe Content Management System files.

StrongPity has been bundled with legitimate software installation files for disguise.

Nebulae uses functions named StartUserModeBrowserInjection and StopUserModeBrowserInjection indicating that it's trying to imitate chrome_frame_helper.dll.

TONESHELL has renamed malicious files to mimic legitimate file names and file extensions. TONESHELL has also masqueraded as legitimate file names to include LogMeIn.dll.

RainyDay has used names to mimic legitimate software including "vmtoolsd.exe" to spoof Vmtools.

AppleSeed has the ability to rename its payload to ESTCommon.dll to masquerade as a DLL belonging to ESTsecurity.

NETWIRE has masqueraded as legitimate software including TeamViewer and macOS Finder.

TinyTurla has been deployed as `w64time.dll` to appear legitimate.

PyDCrypt has dropped DCSrv under the `svchost.exe` name to disk.

J-magic can rename itself as “[nfsiod 0]” to masquerade as the local Network File System (NFS) asynchronous I/O server.

OLDBAIT installs itself in %ALLUSERPROFILE%\\Application Data\Microsoft\MediaPlayer\updatewindws.exe; the directory name is missing a space and the file name is missing the letter "o."

Bad Rabbit has masqueraded as a Flash Player installer through the executable file install_flash_player.exe.

To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start,” “Yahoo Talk,” “MSN Gaming Z0ne,” or “MSN Talk” shortcut.

STATICPLUGIN has leveraged naming conventions that match legitimate services to include AdobePlugins.exe.

TEARDROP files had names that resembled legitimate Window file and directory names.

Machete renamed payloads to masquerade as legitimate Google Chrome, Java, Dropbox, Adobe Reader and Python executables.

DUSTPAN is often disguised as a legitimate Windows binary such as `w3wp.exe` or `conn.exe`.

PUBLOAD has renamed malicious files to mimic legitimate file names such as adobe_wf.exe.

CANONSTAGER has leveraged naming conventions of its malicious DLL to match legitimate services to include cnmpaui.dll which matches the legitimate executable cnmpaui.exe that is aligned with a Canon Ink Jet Printer Assistant Tool.

HexEval Loader has masqueraded and typosquatted as legitimate code repository packages and projects.

Cuckoo Stealer has copied and renamed itself to DumpMediaSpotifyMusicConverter.

InvisiMole has disguised its droppers as legitimate software or documents, matching their original names and locations, and saved its files as mpr.dll in the Windows folder.

CLAIMLOADER has imitated legitimate software directories through the creation and storage of the EXE and DLL in `C:\ProgramData\` and the use of legitimate looking names of software.

QUIETEXIT has attempted to change its name to `cron` upon startup. During incident response, QUIETEXIT samples have been identified that were renamed to blend in with other legitimate files.

RDAT has masqueraded as VMware.exe.

Skidmap has created a fake rm binary to replace the legitimate Linux binary.

TRANSLATEXT has been named `GoogleTranslate.crx` to masquerade as a legitimate Chrome extension.

SameCoin has named files to appear legitimate such as "MicrosoftEdge.exe."

Raindrop was installed under names that resembled legitimate Windows file and directory names.

Doki has disguised a file as a Linux kernel module.

RustyWater has used reddit.exe as its file name and a Cloudflare logo.

Fysbis has masqueraded as trusted software rsyncd and dbus-inotifier.

IcedID has modified legitimate .dll files to include malicious code.

MarkiRAT can masquerade as update.exe and svehost.exe; it has also mimicked legitimate Telegram and Chrome files.

DarkComet has dropped itself onto victim machines with file names such as WinDefender.Exe and winupdate.exe in an apparent attempt to masquerade as a legitimate file.

DRATzarus has been named `Flash.exe`, and its dropper has been named `IExplorer`.

SocGholish has been named `AutoUpdater.js` to mimic legitimate update files.