Class: Trojan-FakeAV
A class of malicious programs that simulate the activity of antivirus software or parts of the operating system security modules. These programs are designed to extort money from users in return for the purported detection and removal of threats, which are in fact non-existent. General speaking, this malware shows many repeating pop-ups in an effort to make the user worry about the security of their system and pay for fake AV software. Additionally, Trojan-FakeAV programs prevent the computer from working properly, but do not fully inhibit the operating system in order to make the user believe that the threat is credible.Read more
Platform: Win32
Win32 is an API on Windows NT-based operating systems (Windows XP, Windows 7, etc.) that supports execution of 32-bit applications. One of the most widespread programming platforms in the world.Family: Onescan
No family descriptionExamples
483E417775ED0A6668385A0BD9450AF108FDF5B2BE096CB4CEAAFE4698E6D19C
F091B18D096790DA47EA710547EBDD81
D9056F33429EA06D366B559E4E171EBA
C99F554450C8E7CFC2111398FF53E759
Tactics and Techniques: Mitre*
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Protocols such as HTTP/S(Citation: CrowdStrike Putter Panda) and WebSocket(Citation: Brazking-Websockets) that carry web traffic may be very common in environments. HTTP/S packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Protocols such as HTTP/S(Citation: CrowdStrike Putter Panda) and WebSocket(Citation: Brazking-Websockets) that carry web traffic may be very common in environments. HTTP/S packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.
* © 2024 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.