# User Execution
Malware may include code that relies on specific actions by a user to execute. Note that this MBC behavior differs from [User Execution](https://attack.mitre.org/techniques/T1204) in that it does do not include direct code execution (user action for *initial* execution) - MBC does not encompass ATT&CK's Initial Access Tactic.
This behavior is related to Unprotect technique U1339.
See ATT&CK Technique: **User Execution ([T1204](https://attack.mitre.org/techniques/T1204/))**.
## Use in Malware
|Name|Date|Method|Description|
|---|---|---|---|
|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--| GoBotKR makes their malware look like the torrent content that the user intended to download, in order to entice a user to click on it. [[1]](#1)|
|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|The malware relies on a victim to execute itself. [[2]](#2)|
|[**Terminator**](../xample-malware/terminator.md)|2013|--|The malware relies on user interaction to execute. [[3]](#3)|
|[**Vobfus**](../xample-malware/vobfus.md)|2016|--|The malware relies on user interaction to run the executable. [[4]](#4)|
|[**CryptoLocker**](../xample-malware/vobfus.md)|2013|--|The malware relies on victims to execute. [[4]](#4)|
|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|The user opens a disk image file which invisibly installs its components. [[6]](#6)|
## References
[1] https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
[2] https://blogs.cisco.com/security/talos/rombertik
[3] https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2013/FireEye-Terminator_RAT.pdf
[4] https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/
[5] https://www.secureworks.com/research/cryptolocker-ransomware
[6] https://www.malwarebytes.com/blog/news/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection