Procedure examples

PowerDuke hides many of its backdoor payloads in an alternate data stream (ADS).

If the victim is using PowerShell 3.0 or later, POWERSOURCE writes its decoded payload to an alternate data stream (ADS) named kernel32.dll that is saved in %PROGRAMDATA%\Windows\.

WastedLocker has the ability to save and execute files as an alternate data stream (ADS).

The Regin malware platform uses Extended Attributes to store encrypted executables.

Some variants of the Zeroaccess Trojan have been known to store data in Extended Attributes.

Anchor has used NTFS to hide files.

Gazer stores configuration items in alternate data streams (ADSs) if the Registry is not accessible.

Latrodectus can delete itself while its process is still running through the use of an alternate data stream.

Valak has the ability save and execute files as alternate data streams (ADS).

LoJax has loaded an embedded NTFS DXE driver to be able to access and write to NTFS partitions.

The DEADEYE.EMBED variant of DEADEYE can embed its payload in an alternate data stream of a local file.

Astaroth can abuse alternate data streams (ADS) to store content for malicious payloads.

BitPaymer has copied itself to the :bin alternate data stream of a newly created file.

esentutl can be used to read and write alternate data streams.

Expand can be used to download or copy a file into an alternate data stream.