Procedure examples

BLINDINGCAN has modified file and directory timestamps.

Ninja can change or create the last access or write times.

Stuxnet extracts and writes driver files that match the times of other legitimate files.

SEASHARPEE can timestomp files on victims using a Web shell.

After creating a new service for persistence, TDTESS sets the file creation time for the service to the creation time of the victim's legitimate svchost.exe file.

Many Misdat samples were programmed using Borland Delphi, which will mangle the default PE compile timestamp of a file.

Bankshot modifies the time of a file as specified by the control server.

UPSTYLE restores timestamps to original values following modification.

BOOKWORM has modified file timestamps from the export address table (EAT) to make it difficult to discern when the module was created.

PingPull has the ability to timestomp a file.

BlackByte 2.0 Ransomware can timestomp files for defense evasion and anti-forensics purposes.

InvisiMole samples were timestomped by the authors by setting the PE timestamps to all zero values. InvisiMole also has a built-in command to modify file times.

CHIMNEYSWEEP can time stomp its executable, previously dating it between 2010 to 2021.

China Chopper's server component can change the timestamp of files.

KeyBoy time-stomped its DLL in order to evade detection.

POSHSPY modifies timestamps of all downloaded executables to match a randomly selected file created prior to 2013.

MultiLayer Wiper changes timestamps of overwritten files to either 1601.1.1 for NTFS filesystems, or 1980.1.1 for all other filesystems.

Elise performs timestomping of a CAB file it creates.

For early Gazer versions, the compilation timestamp was faked.

3PARA RAT has a command to set certain attributes such as creation/modification timestamps on files.

EVILNUM has changed the creation date of files.

TAINTEDSCRIBE can change the timestamp of specified filenames.

Shamoon can change the modified time for files to evade forensic detection.

BPFDoor uses the `utimes()` function to change the executable's timestamp.

Attor has manipulated the time of last access to files and registry keys after they have been created or modified.

NightClub can modify the Creation, Access, and Write timestamps for malicious DLLs to match those of the genuine Windows DLL user32.dll.

The Derusbi malware supports timestomping.

Kobalos can modify timestamps of replaced files, such as ssh with the added credential stealer or sshd used to deploy Kobalos.

HiddenFace can alter timestamps for directory content on targeted machines.

OwaAuth has a command to timestop a file or directory.

Cobalt Strike can timestomp any files or payloads placed on a target machine to help them blend in.

USBStealer sets the timestamps of its dropper files to the last-access and last-write timestamps of a standard Windows library chosen on the system.

OSX_OCEANLOTUS.D can use the touch -t command to change timestamps.

Cyclops Blink has the ability to use the Linux API function `utime` to change the timestamps of modified firmware update images.

MacMa has the capability to create and modify file timestamps.

SPAWNCHIMERA has updated the timestamp using the `touch` command.

Winnti for Windows can set the timestamps for its worker and service components to match that of cmd.exe.

PowerStallion modifies the MAC times of its local log files to match that of the victim's desktop.ini file.

metaMain can change the `CreationTime`, `LastAccessTime`, and `LastWriteTime` file time attributes when executed with `SYSTEM` privileges.

Psylo has a command to conduct timestomping by setting a specified file’s timestamps to match those of a system file in the System32 directory.

Gelsemium has the ability to perform timestomping of files on targeted systems.

BitPaymer can modify the timestamp of an executable so that it can be identified and restored by the decryption tool.

FALLCHILL can modify file or directory timestamps.

Empire can timestomp any files or payloads placed on a target machine to help them blend in.