MITRE ATT&CK Sub-Technique

T1655.001: Match Legitimate Name or Location

ShareX LinkedIn Reddit HN

Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by giving artifacts the name and icon of a legitimate, trusted application (i.e., Settings), or using a package name that matches legitimate, trusted applications (i.e., `com.google.android.gm`). Adversaries may also use the same icon of the file or application they are trying to mimic.

Tactics

Defense Evasion

Platforms

Android, iOS

▪Parent technique

T1655: Masquerading

▪Mitigations (1)

M1011User Guidance

Describes any guidance or training given to users to set particular configuration settings or avoid specific potentially risky behaviors.

▪Used by groups (3)

G0097Bouncing Golf G1019MoustachedBouncer G1028APT-C-23

▪Software using this technique (41)

S0292AndroRATmalware S0301Dendroidmalware S0314X-Agent for Androidmalware S0318XLoader for Androidmalware S0320DroidJackmalware S0418ViceLeakermalware S0419SimBadmalware S0422Anubismalware S0423Ginpmalware S0440Agent Smithmalware S0478EventBotmalware S0480Cerberusmalware S0485Mandrakemalware S0489WolfRATmalware S0506ViperRATmalware S0509FakeSpymalware S0522Exobotmalware S0524AndroidOS/MalLocker.Bmalware S0525Android/AdDisplay.Ashasmalware S0529CarbonStealmalware S0536GPlayedmalware S0539Red Alert 2.0malware S0540Asacubmalware S0544HenBoxmalware S0549SilkBeanmalware S0550DoubleAgentmalware S0551GoldenEaglemalware S0555CHEMISTGAMESmalware S0558Tiktok Promalware S0577FrozenCellmalware S1077Hornbillmalware S1079BOULDSPYmalware S1080Fakecallsmalware S1083Chameleonmalware S1094BRATAmalware S1126Phenakitemalware S1195SpyC23malware S1214Android/SpyAgentmalware S1231GodFathermalware S1243DCHSpymalware S9005DocSwapmalware

▪Reference

T1655.001on MITRE ATT&CK

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.