In my old post I described a list of file names used by malware to impersonate svchost.exe. I thought I will re-visit this post today and provide some more file names that malware is using for impersonation of common file names.

Copyright Notice

Feel free to use it for any individual or academic projects that are non-commercial f.ex. internal automatic malware/ forensic analysis systems that are not available commercially (f.ex. if you want to use it to write an Enscript, or perl/python script, or Yara/Cuckoo/Volatility code highlighting suspicious file names based on the below blacklist you are welcome to do so; if you share the script publicly it’s even better 🙂 ). I do not allow you to use this list in any commercial product or service including, but not limited to sandboxes & automatic malware/forensic processing systems. If you want to use it for anything that has a commercial/reselling purposes or may give a hint of such purpose please contact me first. Please note that this list may be watermarked.

How this list was generated?

This is based on strings extracted from 500K sandbox reports that have been analyzed using various ‘similarity’ functions including Levenshtein distance, prefix/infix/suffix similarities, and visual similarity (the final list has been reviewed manually). In other words, it costed a lot of cycles, hence the licensing note. Thanks for understanding.

Here they are:

chrome.exe

5hrome
a_chrome
cchrome
chorom
chr0me
chro2me
chrom
-chrome
chrome1
chrome10
chrome3
chrome32
chrome9
chromede
chromee
chromeez
chromei
chromes
chromix
chromme
chrommm
chromre
chromse
chromyy
chroom
chroome
chroum
crhome
nichrome

csrss.exe

_cerss
_csrss
carss
ccrs
cress
crrss
crss
crsss
csrcs
csres
csriss
csrlt
csrms
csrmss
csrrss
csrs
csrsc
csrse
csrsess
csrsk
csrsl
csrsrv
csrss_1
csrss_2
csrss_8
csrss_9
csrss32
csrssa
csrssc
csrsses
csrssr
csrsss
csrssw
csrssys
csrst
csrsvc
csrsvr
csrsx
csrtss
csrus
csrvs
cssrs
cssrsa
cssrsr
cssrss
cvrss
scrss

explorer.exe/iexplore.exe

0iexplorer
12iexplore
2ciexplore
2fexplorer
5explore
5xplorer
_iexplors
dexplorer
dxplore
e1xplorer
eexplorer
eexxplorer
eksplorer
ep1orer
esplorer
exeplorer
exlorer
exoplorer
exp10rer
exp1or
exp1ore
exp1orer
exp1ror
exp20re
expiorer
expioror
expl0rer
explarar
explarer
expleror
exploe
exploer
exploere
exploerer
exploiter
exploner
explope
explor
explora
explore
explored
exploree
exploreee
exploreff
explorei
explorep
explorer1
explorer32
explorer64
explorer66
explorer_
explorere
explorerf
explorerr
explorerrr
explorers
explorerv
explorerxx
explorerz
explores
exploret
explorew
exploror
explorr
explorre
explorrer
explorxp
explre3r
explrer
explroer
expoler
expolorer
exporer
exprer
exprlore
exproler
exqlorer
exsplorer
exxplorer
ieioplore
ieplore
ieplorer
iexeplore
iexlorer
iexlplore
iexp1ore
iexp1orer
iexpiore
iexpl0ra
iexpl0re
iexplare
iexplarer
iexplere
iexpllzore
iexplo
iexploer
iexploore
iexplope
iexplor
iexplore32
iexplorea
iexplorei
iexplorer
iexplorer0
iexplorer2
iexplorer7
iexplorers
iexplores
iexploresx
iexploror
iexplorrer
iexplors
iexplory
iexplorz
iexpore
iiexplore
iiexplorer
inexplore
inexplorer
intexplore
ixplorer
lexpiore
lexpl1re
lexpl2re
lexpl3re
lexpl4re
lexpl5re
lexpl6re
lexpl7re
lexpl8re
lexpl9re
lexplare
lexplbre
lexplcre
lexpldre
lexplere
lexplfre
lexplgre
lexplhre
lexplire
lexpljre
lexplkre
lexpllre
lexplmre
lexplnre
lexplore
lexplore_
lexplorer
lexplors
lexplpre
lexplqre
lexplrre
lexplsre
lexpltre
lexplure
lexplvre
lexplwre
lexplxre
lexplyre
lexplzre
msexplorer
netplore
plorer
vbexplorer
wexplorer
winexplore
xeplorer
xplore
xplorer
yyexplorer

firefox.exe

5cfirefox
5irefox
f1ref0x
fire10fox
firef0x
firefly
firefo
firefox_
firefox2
firefox32
firefoxe
firefoxx
firfox
irefox
refox
wireox

java.exe

jav3
java32
javaa
javaaa
javaap
javac
javacp
javag
javaii
javapw
javar
javare
javas
javas5
javasc
javase
javaup
javavm
javaw
javaws
javawz
javax
javo
javz

lsass.exe

1sass
iass
isaas
isas
isass
issass
laass
lamss
larss
lass
lassa
lasse
lasss
lcass
leass
lhssass
lrass
lrsss
lsa32
lsac
lsacs
lsaess
lsaoss
lsas
lsasa
lsasas
lsascs
lsase
lsasi
lsasm
lsaso
lsasrv
lsass3
lsass32
lsass47
lsassi
lsassn
lsasss
lsassv
lsassx
lsassys
lsats
lsmass
lsrss
lssas
lssass
msass
nsrss
salss

svchost.exe

_sachost
_svch0st
_svchost
00svchost
0svchost
achost
chost
cvhost
cvshost
isvchosty
lsvchost
mscchost
msvchost
ntsvchost
rdchost
s_host
sach0st
sachost
sachostc
sachostp
sachostp
sachosts
sachosts
sachostw
sachostw
sachostx
sathost
sbhost
scanost
scchost
scchost
scchost2
scchostc
scchostc
scghost
schost
schost
schostc
schosts
schovst
schvost
scvchost
scvchusts
scvh0st
scvh0st
scvhost
scvhost
scvhosv
scvost
scvvhost
sdchost
sdhost
serhost
servehost
sethost
sevchos
sevhost
shchost
shhost
shost
shvchost
shvhost
sichost
slchost
slihost
smsvchost
snahost
snhost
snphost
snvhost
sochost
sochvst
soohost
spchost
sqlhost
srchost
srshost
srvchost
srvchost
srvhost
sschost
sshost
ssvch0st
ssvchost
ssvchost
ssvichosst
st#host
stdhost
suchost
suchost
suchostp
suchostp
suchosts
suchosts
sv_host
sv±hest
sv0hoat
sv1host
svahost
svahost
svcbost
svcchost
svcchost
svcehost
svcehost
svcgest
svcgh0st
svcgoost
svch0sat
svch0sbt
svch0set
svch0sft
svch0slt
svch0smt
svch0st
svch0st
svch0st_
svch0sts
svch7t
svchaot
svchast
svchast
svchcst
svchcst
svchest
svchest
svchhost
svchîst
svchkost
svcho
svchobst
svchoct
svcholts
svchon32
svchoost
svchoot
svchort
svchos
svchos12
svchosd
svchosf
svchosf
svchosi
svchosl
svchoso
svchosr
svchoss
svchosst
svchost
svchost
svchöst
svchost_
svchost_cz
svchost”
svchost0
svchost1
svchost10
svchost16
svchost2
svchost2
svchost3
svchost3
svchost31
svchost32
svchost32
svchost4
svchost5
svchost6
svchost64
svchost64
svchosta
svchostbb
svchostbd
svchostbn
svchostc
svchostc32
svchostcx
svchostd
svchostdll
svchoste
svchosted
svchosti
svchosting
svchostit
svchostl
svchostms
svchosto
svchostr
svchostre
svchosts
svchosts
svchosts32
svchostsr
svchostss
svchostt
svchostt
svchostþ
svchostun
svchostv
svchostv
svchostxi
svchostxi
svchostxxx
svchostz
svchosv
svchosy
svchot
svchoto
svchots
svchots
svchott
svchowb
svchowt
svchoxt
svchoxt
svchpst
svchpst
svchqs
svchqst
svchs0t
svchsot
svchsot
svchsst
svchssts
svchst
svchste
svchsts
svchtst
svchust
svchusts
svcinit
svcjhost
svclost
svcmost
svcnost
svcnost
svcohst
svcomst
svcoost
svcost
svcpos
svcroot
svcroot
svcshtost
svcsoft
svcsost
svcst
svctos
svcxhost
svdhost
svdhost
svdnost
svehost
svehost
svgchost
svggost
svghost
svghost
svghosts
svh0st
svhcost
svhest
svhoct
svhosit
svhosr
svhosst
svhost
svhost
svhost1
svhost2
svhostc
svhoste
svhostr
svhosts
svhostt
svhostu
svhot
svhst
svhust
svichosst
svichost
svlhost
svnchost
svnhost
svohcst
svohcst
svohost
svohost
svohst
svost
svphost
svphost
svphostu
svphostu
svrhost
svrhost
svschost
svschost
svschosta
svsh0st
svsh0st
svshoct
svshost
svshost
svshosti
svshosts
svshot
svuhost
svvchcst
svvchost
svvghost
svvhost
svvhost
svvhosti
svwhost
svxhos
svxhost
swchost
swchost
swdhost
swhost
swhost
sxhost
sxhost
sychost
synchost
synchost
synhost
syschost
syschost
syshost
syshost
szchostc
szchostc
tsvchost
usvchost
uvchost
vcchost
vchost
vhchost
vhost
vschost
vshost
vsschost
vxhost
wsvchost
wvchosd
xvshost
zvchost

win.exe (and similar/related names)

mswin
win_
win_5
win00
win01
win07
win08
win09
win1
win10
win11
win16
win2
win22
win23
win3
win30
win32
win39
win4
win42
win44
win45
win5
win54
win55
win62
win64
win7
win76
win77
win8
win91
win96
win98
win9x
wina
winad
winar
winav
winb
winc
wince
wind
wind3
windf
windm
winds
wine
winet
winex
winfc
wingb
wings
wingt
winhd
winhv
wini
winit
wink
winkl
winl
winlc
winma
winmm
winmn
winmx
winn
winn1
winns
winnt
winny
winog
winok
winos
winow
winp9
winpc
winr
winra
winrm
winrr
wins
wins7
winsh
winsp
winss
winst
wint
winu
winud
winup
winvc
winvr
winw
winwl
winwn
winws
winx
winxp
winxv
winz

winlogon.exe

_winlogon
inlogon
nlogon
wgalogon
wimlogom
win_logn
win1ogo
win1ogon
win1ogons
windlogon
winiogon
winl0g0n
winl0gin
winl0gon
winlgon
winligon
winlngon
winlog
winlog056
winlog0n
winlog1
winlogan
winloge
winlogen
winloger
winlogin
winlogins
winlogn
winlogo
winlogom
winlogoms
winlogon1
winlogon3
winlogon32
winlogon6
winlogon86
winlogone
winlogonl
winlogonn
winlogonpc
winlogonr
winlogons
winlogor
winlogr
winlogs
winlogun
winlongon
winlugan
winslogin
wnilogon
wnlgon
wnlogin