> Concept · legitimate-library-masquerade_

~/packetpursuit $ cat /intel/concepts/legitimate-library-masquerade.md

typeconceptconfidencemediumcreated2026-06-20updated2026-06-20evasiondefense-evasionresearch-target

legitimate-library-masquerade

Cross-family pattern: malware authors clone the identity metadata (copyright, product name, version info, description, company) of a real open-source or commercial library/framework to make their binary appear benign during superficial triage.

Variants Observed

  • TransMock clone (f3bc22f6) — .NET PE reuses full TransMock version block (Copyright TransMock 2017, v1.3.0.0, Easily mock the communication endpoints of BizTalk integrations) while hosting WinHTTP downloader and encryption classes. ^[/intel/analyses/f3bc22f69502ed934da8dea7940437e820e1c778016e330a28b1103b6ca247b1.html]

Detection

Check FileVersionInfo / AssemblyInfo against known benign projects. Mismatches between:

  • InternalName / OriginalFilename and the known project binary name
  • PDB paths revealing a different build environment (Admin2024\Desktop\Outputs\Udflopli.pdb vs TransMock)
  • Class namespaces that reuse the legitimate namespace but inject alien classes (TransMock.Utility.CrewPickupSM)

Related