Technique:  Masquerading
AppleSeed can disguise JavaScript files as PDFs.
It has renamed the WinRAR utility to avoid detection.
It has disguised a Cobalt Strike beacon as a Flash Installer.
Bisonal dropped a decoy payload with a .jpg extension that contained a malicious Visual Basic script.
BoomBox has the ability to mask malicious data strings as PDF files.
It has masked executables with document file icons including Word and Adobe PDF.
During C0015, the threat actors named a binary file compareForfor.jpg to disguise it as a JPG file.
During C0018, AvosLocker was disguised using the victim company name as the filename.
The Dacls Mach-O binary has been disguised as a .nib file.
DarkTortilla's payload has been renamed PowerShellInfo.exe.
DarkWatchman has used an icon mimicking a text file to mask a malicious executable.
It has created accounts disguised as legitimate backup and service accounts as well as an email administration account.
EnvyScout has used folder icons for malicious files to lure victims into opening them.
FatDuke has attempted to mimic a compromised user's traffic by using the same user agent as the installed browser.
It has masqueraded staged data by using the Windows certutil utility to generate fake Base64 encoded certificates with the input file.
Flagpro can download malicious files with a .tmp extension and append them with .exe prior to execution.
FoggyWeb can masquerade the output of C2 commands as a fake, but legitimately formatted WebP file.
It has disguised its C2 addresses as the websites of shopping malls, governments, universities, and others.
It has used several different security software icons to disguise executables.
It has used esentutl to change file extensions to their true type that were masquerading as .txt files.
Milan has used an executable named companycatalogue to appear benign.
NativeZone has, upon execution, displayed a message box that appears to be related to a Ukrainian electronic document management system.
It attempted to make Octopus appear as a  Telegram Messenger with a Russian interface.
NotPetya drops PsExec with the filename dllhost.dat.
It has used .doc file extensions to mask malicious executables.
For Operation Dust Storm, the threat actors disguised some executables as JPG files.
During Operation Honeybee, the threat actors modified the MaoCheng dropper so its icon appeared as a Word document.
It has renamed rar.exe to avoid detection.
PowGoop has disguised a PowerShell script as a .dat file (goopdate.dat).
Raindrop was built to include a modified version of 7-Zip source code (including associated export names) and Far Manager source code.
Ramsay has masqueraded as a JPG image file.
RCSession has used a file named English.rtf to appear benign on victim hosts.
It has been delivered as archived Windows executable files masquerading as PDF documents.
Ryuk can create .dll files that actually contain a Rich Text File format document.
Saint Bot has renamed malicious binaries as wallpaper.mp4 and slideshow.mp4 to avoid detection.
During the SolarWinds Compromise, It set the hostnames of their C2 infrastructure to match legitimate hostnames in the victim environment. They also used IP addresses originating from the same country as the victim for their VPN infrastructure.
SombRAT can use a legitimate process name to hide itself.
It has masked malware DLLs as dat and jpg files.
It has disguised their scripts with docker-related file names.
TrailBlazer has used filenames that match the name of the compromised system in attempt to avoid detection.
The TrickBot downloader has used an icon to appear as a Microsoft Word document.
WhisperGate has been disguised as a JPG extension to avoid detection as a malicious PE file.
It has used icons mimicking MS Office files to mask malicious executables. It has also attempted to hide executables by changing the file extension to ".scr" to mimic Windows screensavers.
WindTail has used icons mimicking MS Office files to mask payloads.
XCSSET builds a malicious application bundle to resemble Safari through using the Safari icon and Info.plist.
ItM has spoofed legitimate applications in phishing lures and changed file extensions to conceal  installation of malware.