value:  BLINDINGCAN has modified file and directory timestamps. ;; Chimera has used a Windows version of the Linux touch command to modify the date and time stamp on DLLs. ;; China Chopper's server component can change the timestamp of files. ;; Cobalt Strike can timestomp any files or payloads placed on a target machine to help them blend in. ;; The Derusbi malware supports timestomping. ;; Elise performs timestomping of a CAB file it creates. ;; Empire can timestomp any files or payloads placed on a target machine to help them blend in. ;; EVILNUM has changed the creation date of files. ;; FALLCHILL can modify file or directory timestamps. ;; For early Gazer versions the compilation timestamp was faked. ;; InvisiMole samples were timestomped by the authors by setting the PE timestamps to all zero values. InvisiMole also has a built-in command to modify file times. ;; KeyBoy time-stomped its DLL in order to evade detection. ;; Kimsuky has manipulated timestamps for creation or compilation dates to defeat anti-forensics. ;; Several Lazarus Group malware families use timestomping including modifying the last write timestamp of a specified Registry key to a random date as well as copying the timestamp for legitimate .exe files (such as calc.exe or mspaint.exe) to its dropped files. ;; Many Misdat samples were programmed using Borland Delphi which will mangle the default PE compile timestamp of a file. ;; OSX_OCEANLOTUS.D can use the touch command to change timestamps. ;; OwaAuth has a command to timestop a file or directory. ;; POSHSPY modifies timestamps of all downloaded executables to match a randomly selected file created prior to 2013. ;; PowerStallion modifies the MAC times of its local log files to match that of the victim's desktop.ini file. ;; Psylo has a command to conduct timestomping by setting a specified file’s timestamps to match those of a system file in the System32 directory. ;; Rocke has changed the time stamp of certain files. ;; SEASHARPEE can timestomp files on victims using a Web shell. ;; Shamoon can change the modified time for files to evade forensic detection. ;; TAINTEDSCRIBE can change the timestamp of specified filenames. ;; After creating a new service for persistence TDTESS sets the file creation time for the service to the creation time of the victim's legitimate svchost.exe file. ;; TEMP.Veles used timestomping to modify the $STANDARD_INFORMATION attribute on tools. ;; UNC2452 modified timestamps of backdoors to match legitimate Windows files. ;; USBStealer sets the timestamps of its dropper files to the last-access and last-write timestamps of a standard Windows library chosen on the system.
name: Indicator Removal on Host: Timestomp