{
  "family": "fakedos",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nFakeDoS is a deceptive malware family categorized as a Trojan, often masquerading as a legitimate network testing tool or a \"stress tester\" (DDoS tool) for script kiddies. While the user believes they are downloading a tool to launch denial-of-service attacks against others, FakeDoS actually infects the host system, frequently acting as a backdoor or enlisting the machine into an actual botnet controlled by the malware author.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFakeDoS is primarily distributed via cybercrime forums, gaming cheat sites, and untrustworthy software portals where users actively seek out \"stresser\" tools or \"booters.\"\n\nUpon execution, the malware exhibits a \"bait and switch\" execution flow:\n<ul>\n<li><strong>Deceptive UI:</strong> The program may present a graphical user interface (GUI) allowing the user to enter a target IP address to \"attack.\" When initiated, it simulates an attack, often displaying fake console outputs to maintain the illusion of functionality.</li>\n<li><strong>Covert Payload Execution:</strong> While the fake UI is running, the core malware silently executes in the background. It establishes persistence by modifying the Windows Registry (`HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`) to ensure it survives system reboots.</li>\n<li><strong>Botnet Assimilation:</strong> FakeDoS typically connects to a hardcoded command-and-control (C2) server. Instead of the user controlling the attacks, their machine is assimilated into a botnet. The C2 server can now command the infected host to launch actual DDoS attacks (e.g., UDP floods, SYN floods) or download secondary payloads like info-stealers.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA FakeDoS infection is a significant security risk. It not only compromises the integrity of the endpoint but also turns the organization's infrastructure into an unwitting participant in cybercrime, potentially leading to the organization's IP space being blacklisted by global ISPs and security vendors.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Network Monitoring:</strong> Analyze edge firewall logs for sustained, high-volume outbound traffic to unknown IP addresses or anomalous communication over non-standard ports, which indicates the machine is participating in a botnet attack.</li>\n<li><strong>Endpoint Isolation:</strong> Isolate the infected endpoint from the LAN immediately to halt any outbound attacks and sever the C2 connection.</li>\n<li><strong>Security Awareness Training:</strong> The presence of FakeDoS indicates a user intentionally attempted to download and execute malicious hacking tools. This requires immediate administrative review and targeted security awareness training regarding acceptable use policies.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.FakeDoS",
    "HackTool.FakeDoS",
    "Win32/FakeDoS"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1059",
    "T1547.001",
    "T1583.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:04:40Z",
  "type": "Trojan (Fake Tool)",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}