Application data folder is a very popular destination for malware. The files are typically dropped either directly inside it, or into subdirectories that are either randomized, leverage existing OS subdirectories, or sometimes malware creates their own – often mimicking the well-known applications’ folders (f.ex. Mozilla).<\/p>\n
The attached list<\/a> contains over 7000 file names for files that are ‘dropped’ inside the application data folder. The file names are extracted from a large set of sandbox reports.<\/p>\n Once stuffed in the folder, the malware often dresses itself impersonating popular applications f.ex.:<\/p>\n chrome.exe<\/strong><\/p>\n firefox.exe<\/strong><\/p>\n java.exe<\/strong><\/p>\n smss.exe<\/strong><\/p>\n and so on and so forth including some ridiculous Corporate hybrids like these:<\/p>\n or AV impersonators:<\/p>\n Since it’s a blacklist, it can be applied to hunting and file list analysis. FPs are definitely there, so you have been warned \ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":" Application data folder is a very popular destination for malware. The files are typically dropped either directly inside it, or into subdirectories that are either randomized, leverage existing OS subdirectories, or sometimes malware creates their own – often mimicking the … Continue reading \n
\n
\n
\n
\n
\n