Update Date
10/26/2023

Class: Trojan-FakeAV

A class of malicious programs that simulate the activity of antivirus software or parts of the operating system security modules. These programs are designed to extort money from users in return for the purported detection and removal of threats, which are in fact non-existent. General speaking, this malware shows many repeating pop-ups in an effort to make the user worry about the security of their system and pay for fake AV software. Additionally, Trojan-FakeAV programs prevent the computer from working properly, but do not fully inhibit the operating system in order to make the user believe that the threat is credible.

Read more

Platform: Win32

Win32 is an API on Windows NT-based operating systems (Windows XP, Windows 7, etc.) that supports execution of 32-bit applications. One of the most widespread programming platforms in the world.

Family: Onescan

No family description

Examples

483E417775ED0A6668385A0BD9450AF1
08FDF5B2BE096CB4CEAAFE4698E6D19C
F091B18D096790DA47EA710547EBDD81
D9056F33429EA06D366B559E4E171EBA
C99F554450C8E7CFC2111398FF53E759

Tactics and Techniques: Mitre*

TA0011
Command and Control

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.


Protocols such as HTTP/S(Citation: CrowdStrike Putter Panda) and WebSocket(Citation: Brazking-Websockets) that carry web traffic may be very common in environments. HTTP/S packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.


T1071.001
Application Layer Protocol: Web Protocols

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.


Protocols such as HTTP/S(Citation: CrowdStrike Putter Panda) and WebSocket(Citation: Brazking-Websockets) that carry web traffic may be very common in environments. HTTP/S packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.


* © 2024 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

Kaspersky Next
Let’s go Next: redefine your business’s cybersecurity
Learn more
New Kaspersky!
Your digital life deserves complete protection!
Learn more
Confirm changes?
Your message has been sent successfully.