value:  BADNEWS attempts to hide its payloads using legitimate filenames. ;; The Bazar loader has named malicious shortcuts adobe. ;; BLINDINGCAN has attempted to hide its payload by using legitimate file names such as "iconcache.db". ;; Blue Mockingbird has masqueraded their XMRIG payload name by naming it wercplsupporte.dll after the legitimate wercplsupport.dll file. ;; BRONZE BUTLER has given malware the same name as an existing file on the file share server to cause users to unwittingly launch and install the malware on additional systems. ;; Bundlore has disguised a malicious .app file as a Flash Player update. ;; Calisto's installation file is an unsigned DMG image under the guise of Intego’s security solution for mac. ;; Carbanak has named malware "svchost.exe " which is the name of the Windows shared service host program. ;; Carberp has masqueraded as Windows system file names as well as "chkntfs.exe" and "syscron.exe". ;; ChChes copies itself to an .exe file with a filename that is likely intended to imitate Norton Antivirus but has several letters reversed (e.g. notron.exe). ;; Chimera has renamed malware to GoogleUpdate.exe and WinRAR to jucheck.exe RecordedTV.ms teredo.tmp update.exe and msadcs1.exe. ;; DarkComet has dropped itself onto victim machines with file names such as WinDefender.Exe and winupdate.exe in an apparent attempt to masquerade as a legitimate file. ;; Darkhotel has used malware that is disguised as a Secure Shell (SSH) tool. ;; Daserf uses file and folder names related to legitimate programs in order to blend in such as HP Intel Adobe and perflogs. ;; Doki has disguised a file as a Linux kernel module. ;; One of Dtrack can hide in replicas of legitimate programs like OllyDbg 7-Zip and FileZilla. ;; If installing itself as a service fails Elise instead writes itself as a file named svchost.exe saved in %APPDATA%\Microsoft\Network. ;; FatDuke has attempted to mimic a compromised user's traffic by using the same user agent as the installed browser. ;; Felismus has masqueraded as legitimate Adobe Content Management System files. ;; FinFisher renames one of its .dll files to uxtheme.dll in an apparent attempt to masquerade as a legitimate file. ;; Fox Kitten has named binaries and configuration files svhost and dllhost respectively to appear legitimate. ;; Fysbis has masqueraded as trusted software rsyncd and dbus-inotifier. ;; GoldenSpy's setup file installs initial executables under the folder %WinDir%\System32\PluginManager. ;; GoldMax appeared as a scheduled task impersonating systems management software within the corresponding ProgramData subfolder. ;; Goopy has impersonated the legitimate goopdate.dll which was dropped on the target system with a legitimate GoogleUpdate.exe. ;; Grandoreiro has named malicious browser extensions and update files to appear legitimate. ;; Hildegard has disguised itself as a known Linux process. ;; HTTPBrowser's installer contains a malicious file named navlu.dll to decrypt and run the RAT. navlu.dll is also the name of a legitimate Symantec DLL. ;; Indrik Spider used fake updates for FlashPlayer plugin and Google Chrome as initial infection vectors. ;; InnaputRAT variants have attempted to appear legitimate by using the file names SafeApp.exe and NeutralApp.exe. ;; InvisiMole has disguised its droppers as legitimate software or documents matching their original names and locations and saved its files as mpr.dll in the Windows folder. ;; Ixeshe has used registry values and file names associated with Adobe software such as AcroRd32.exe. ;; KGH_SPY has masqueraded as a legitimate Windows tool. ;; KONNI creates a shortcut called "Anti virus service.lnk" in an apparent attempt to masquerade as a legitimate file. ;; Lazarus Group has renamed the TAINTEDSCRIBE main executable to disguise itself as Microsoft's narrator. ;; LightNeuron has used filenames associated with Exchange and Outlook for binary and configuration files such as winmail.dat. ;; LookBack has a C2 proxy tool that masquerades as GUP.exe which is software used by Notepad++. ;; Machete's Machete MSI installer has masqueraded as a legitimate Adobe Acrobat Reader installer. ;; Machete renamed payloads to masquerade as legitimate Google Chrome Java Dropbox Adobe Reader and Python executables. ;; MCMD has been named Readme.txt to appear legitimate. ;; MechaFlounder has been downloaded as a file named lsass.exe which matches the legitimate Windows file. ;; menuPass has been seen changing malicious files to appear legitimate. ;; Metamorfo has disguised an MSI file as the Adobe Acrobat Reader Installer. ;; Mis-Type saves itself as a file named msdtc.exe which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary. ;; Misdat saves itself as a file named msdtc.exe which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary. ;; MuddyWater has disguised malicious executables and used filenames and Registry key names associated with Windows Defender. ;; Mustang Panda has used 'adobeupdate.dat' as a PlugX loader and a file named 'OneDrive.exe' to load a Cobalt Strike payload. ;; NETWIRE has masqueraded as legitimate software including TeamViewer and macOS Finder. ;; NOKKI is written to %LOCALAPPDATA%\MicroSoft Updatea\svServiceUpdate.exe prior being executed in a new process in an apparent attempt to masquerade as a legitimate folder and file. ;; OLDBAIT installs itself in %ALLUSERPROFILE%\Application Data\Microsoft\MediaPlayer\updatewindws.exe; the directory name is missing a space and the file name is missing the letter "o." ;; OSX/Shlayer can masquerade as a Flash Player update. ;; OwaAuth uses the filename owaauth.dll which is a legitimate file that normally resides in %ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\Auth\; the malicious file by the same name is saved in %ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\bin\. ;; Patchwork installed its payload in the startup programs folder as "Baidu Software Update." The group also adds its second stage payload to the startup programs as “Net Monitor." They have also dropped QuasarRAT binaries as files named microsoft_network.exe and crome.exe. ;; Penquin has mimicked the Cron binary to hide itself on compromised systems. ;; PipeMon modules are stored on disk with seemingly benign names including use of a file extension associated with a popular word processor. ;; Pony has used the Adobe Reader icon for the downloaded file to look more trustworthy. ;; Poseidon Group tools attempt to spoof anti-virus processes as a means of self-defense. ;; PROMETHIUM has disguised malicious installer files by bundling them with legitimate software installers. ;; PUNCHBUGGY mimics filenames from %SYSTEM%\System32 to hide DLLs in %WINDIR% and/or %TEMP%. ;; Pysa has executed a malicious executable by naming it svchost.exe. ;; QUADAGENT used the PowerShell filenames Office365DCOMCheck.ps1 and SystemDiskClean.ps1. ;; Raindrop was installed under names that resembled legitimate Windows file and directory names. ;; Ramsay has masqueraded as a 7zip installer. ;; RDAT has masqueraded as VMware.exe. ;; The Remsec loader implements itself with the name Security Support Provider a legitimate Windows function. Various Remsec .exe files mimic legitimate file names used by Microsoft Symantec Kaspersky Hewlett-Packard and VMWare. Remsec also disguised malicious modules using similar filenames as custom network encryption software on victims. ;; REvil can mimic the names of known executables. ;; Rocke has used shell scripts which download mining executables and saves them with the filename "java". ;; Ryuk has constructed legitimate appearing installation folder paths by calling GetWindowsDirectoryW and then inserting a null byte at the fourth character of the path. For Windows Vista or higher the path would appear as C:\Users\Public. ;; S-Type may save itself as a file named msdtc.exe which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary. ;; Sandworm Team has avoided detection by naming a malicious binary explorer.exe. ;; ShimRatReporter spoofed itself as AlphaZawgyl_font.exe a specialized Unicode font. ;; Sibot has downloaded a DLL to the C:\windows\system32\drivers\ folder and renamed it with a .sys extension. ;; Sidewinder has named malicious files rekeywiz.exe to match the name of a legitimate Windows executable. ;; Silence has named its backdoor "WINWORD.exe". ;; Skidmap has created a fake rm binary to replace the legitimate Linux binary. ;; SLOTHFULMEDIA has mimicked the names of known executables such as mediaplayer.exe. ;; Sowbug named its tools to masquerade as Windows or Adobe Reader software such as by using the file name adobecms.exe and the directory CSIDL_APPDATA\microsoft\security. ;; To establish persistence SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start ” “Yahoo Talk ” “MSN Gaming Z0ne ” or “MSN Talk” shortcut. ;; Starloader has masqueraded as legitimate software update packages such as Adobe Acrobat Reader and Intel. ;; StrongPity has been bundled with legitimate software installation files for disguise. ;; SUNBURST created VBScripts that were named after existing services or folders to blend into legitimate activities. ;; SUNSPOT was identified on disk with a filename of taskhostsvc.exe and it created an encrypted log file at C:\Windows\Temp\vmware-vmdmp.log. ;; SUPERNOVA has masqueraded as a legitimate SolarWinds DLL. ;; The TAINTEDSCRIBE main executable has disguised itself as Microsoft’s Narrator. ;; TEARDROP files had names that resembled legitimate Window file and directory names. ;; TEMP.Veles has renamed files to look like legitimate files such as Windows update files or Schneider Electric application files. ;; ThiefQuest prepends a copy of itself to the beginning of an executable file while maintaining the name of the executable. ;; Tropic Trooper has hidden payloads in Flash directories and fake installer files. ;; UNC2452 renamed a version of AdFind to sqlceip.exe or csrss.exe in an attempt to appear as the SQL Server Telemetry Client or Client Service Runtime Process respectively. ;; Ursnif has used strings from legitimate system files and existing folders for its file folder and Registry entry names. ;; USBStealer mimics a legitimate Russian program called USB Disk Security. ;; Whitefly has named the malicious DLL the same name as DLLs belonging to legitimate software from various security vendors. ;; A Winnti for Windows implant file was named ASPNET_FILTER.DLL mimicking the legitimate ASP.NET ISAPI filter DLL with the same name. ;; ZLib mimics the resource version information of legitimate Realtek Semiconductor Nvidia or Synaptics modules."
name: Masquerading: Match Legitimate Name Or Location