Procedure examples

AvosLocker has been disguised as a .jpg file.

HeartCrypt can append a BMP header to encoded malicious payloads to masquerade them as BMP files.

STATICPLUGIN has masqueraded as a BMP file to hide its true MSI file extension.

Raspberry Robin has historically been delivered via infected USB drives containing a malicious LNK object masquerading as a legitimate folder.

Lumma Stealer has used payloads that resemble benign file extensions such as .mp3, .accdb, and .pub, though the files contained malicious JavaScript content.

PureCrypter has used a .NET downloader named 63342221.BAT and has used .jpg, .png, and .log as false extensions for malicious files.

MagicRAT can download additional executable payloads that masquerade as GIF files.

StrelaStealer has been distributed as a DLL/HTML polyglot file.

Kapeka masquerades as a Microsoft Word Add-In file, with the extension `.wll`, but is a malicious DLL file.

OSX_OCEANLOTUS.D has disguised it's true file structure as an application bundle by adding special characters to the filename and using the icon for legitimate Word documents.

ANDROMEDA has been delivered through a LNK file disguised as a folder.

The QakBot payload has been disguised as a PNG file and hidden within LNK files using a Microsoft File Explorer icon.

Brute Ratel C4 has used Microsoft Word icons to hide malicious LNK files.