Indicator Removal: Timestomp

3PARA RAT has a command to set certain attributes such as creation/modification timestamps on files.^[5]

APT28 has performed timestomping on victim files.^[6]

APT29 has used timestomping to alter the Standard Information timestamps on their web shells to match other files in the same directory.^[7]

APT32 has used scheduled task raw XML with a backdated timestamp of June 2, 2016. The group has also set the creation time of the files dropped by the second stage of the exploit to match the creation time of kernel32.dll. Additionally, APT32 has used a random value to modify the timestamp of the file storing the clientID.^[8][9][10]

APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.^[11]

APT5 has modified file timestamps.^[12]

Attor has manipulated the time of last access to files and registry keys after they have been created or modified.^[13]

Bankshot modifies the time of a file as specified by the control server.^[14]

BitPaymer can modify the timestamp of an executable so that it can be identified and restored by the decryption tool.^[15]

BLINDINGCAN has modified file and directory timestamps.^[16][17]

BPFDoor uses the utimes() function to change the executable's timestamp.^[18]

During the C0032 campaign, TEMP.Veles used timestomping to modify the $STANDARD_INFORMATION attribute on tools.^[19]

Chimera has used a Windows version of the Linux touch command to modify the date and time stamp on DLLs.^[20]

CHIMNEYSWEEP can time stomp its executable, previously dating it between 2010 to 2021.^[21]

China Chopper's server component can change the timestamp of files.^[22][23][24]

Cobalt Strike can timestomp any files or payloads placed on a target machine to help them blend in.^[25][26]

During Cutting Edge, threat actors changed timestamps of multiple files on compromised Ivanti Secure Connect VPNs to conceal malicious activity.^[27][28]

Cyclops Blink has the ability to use the Linux API function utime to change the timestamps of modified firmware update images.^[29]

The Derusbi malware supports timestomping.^[30][31]

Elise performs timestomping of a CAB file it creates.^[32]

Empire can timestomp any files or payloads placed on a target machine to help them blend in.^[33]

EVILNUM has changed the creation date of files.^[34]

FALLCHILL can modify file or directory timestamps.^[35]

For early Gazer versions, the compilation timestamp was faked.^[36]

Gelsemium has the ability to perform timestomping of files on targeted systems.^[37]

InvisiMole samples were timestomped by the authors by setting the PE timestamps to all zero values. InvisiMole also has a built-in command to modify file times.^[38]

KeyBoy time-stomped its DLL in order to evade detection.^[39]

Kimsuky has manipulated timestamps for creation or compilation dates to defeat anti-forensics.^[40]

Kobalos can modify timestamps of replaced files, such as ssh with the added credential stealer or sshd used to deploy Kobalos.^[41]

Several Lazarus Group malware families use timestomping, including modifying the last write timestamp of a specified Registry key to a random date, as well as copying the timestamp for legitimate .exe files (such as calc.exe or mspaint.exe) to its dropped files.^{[42][43][44][45]}

MacMa has the capability to create and modify file timestamps.^[46]

metaMain can change the CreationTime, LastAccessTime, and LastWriteTime file time attributes when executed with SYSTEM privileges.^[47]

Many Misdat samples were programmed using Borland Delphi, which will mangle the default PE compile timestamp of a file.^[48]

MultiLayer Wiper changes timestamps of overwritten files to either 1601.1.1 for NTFS filesystems, or 1980.1.1 for all other filesystems.^[49]

NightClub can modify the Creation, Access, and Write timestamps for malicious DLLs to match those of the genuine Windows DLL user32.dll.^[50]

Ninja can change or create the last access or write times.^[51]

OSX_OCEANLOTUS.D can use the touch -t command to change timestamps.^[52][53]

OwaAuth has a command to timestop a file or directory.^[54]

PingPull has the ability to timestomp a file.^[55]

POSHSPY modifies timestamps of all downloaded executables to match a randomly selected file created prior to 2013.^[56]

PowerStallion modifies the MAC times of its local log files to match that of the victim's desktop.ini file.^[57]

Psylo has a command to conduct timestomping by setting a specified file’s timestamps to match those of a system file in the System32 directory.^[58]

Rocke has changed the time stamp of certain files.^[59]

SEASHARPEE can timestomp files on victims using a Web shell.^[60]

Shamoon can change the modified time for files to evade forensic detection.^[61]

During the SolarWinds Compromise, APT29 modified timestamps of backdoors to match legitimate Windows files.^[62]

Stuxnet extracts and writes driver files that match the times of other legitimate files.^[63]

TAINTEDSCRIBE can change the timestamp of specified filenames.^[64]

After creating a new service for persistence, TDTESS sets the file creation time for the service to the creation time of the victim's legitimate svchost.exe file.^[65]

USBStealer sets the timestamps of its dropper files to the last-access and last-write timestamps of a standard Windows library chosen on the system.^[66]

Winnti for Windows can set the timestamps for its worker and service components to match that of cmd.exe.^[67]