{
  "family": "fakefolder",
  "sample_count": 7,
  "category": "ransomware",
  "description": "Trojan:Win32/Fakefolder (or generic **Folder Icon Spoofing** heuristics) represents a classic, yet highly effective social engineering tactic utilized primarily by USB worms and specific trojans. The malware deliberately changes its executable icon to match the standard yellow Windows Folder icon and hides the actual legitimate directories. The goal is to trick a user into double-clicking what they believe is a folder, which instead executes the malicious payload.<br><br><b>Understanding Fakefolder Tactics</b><br>To an end-user, this attack is highly deceptive. They plug in a USB drive, see a folder named 'Documents' with the correct icon, and double-click it. For a security analyst, this represents a reliance on user deception (`T1036.004`) rather than complex exploits. While the delivery mechanism is simple, the payloads hidden behind the fake folder icon can range from massive botnets to severe ransomware.<br><br><b>Execution and Deception Mechanics</b><br>Fakefolder malware typically spreads via removable media (USB drives) (`T1091`) or network shares (`T1080`). Upon infecting a drive, the malware marks all existing legitimate folders as 'Hidden' and 'System' files (`T1564.001`), making them invisible to the default Windows Explorer view. It then copies its own malicious executable (`.exe`, `.vbs`, or `.scr`) to the root of the drive, renaming itself to match the names of the hidden folders. Crucially, it embeds the standard `shell32.dll` folder icon into its executable (`T1036.004`). When the victim double-clicks the 'folder' (`T1204.002`), the malware executes. To maintain the illusion, the malware will often simultaneously open a new Explorer window displaying the contents of the *actual* hidden folder, so the user never realizes they just ran an executable.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the execution of a secondary payload (often a worm that will continue to spread). The most glaring host-based IoC is the presence of executables (`.exe`) that share the exact names of directories on a USB drive or network share. A sudden spike in EDR alerts originating from executions on removable media (`D:\\`, `E:\\`) is a strong indicator of a Fakefolder worm outbreak.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1204.002",
    "T1564.001",
    "T1091",
    "T1036.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1036.004",
      "name": "Masquerading: Masquerade Task or Service (Spoofing the folder icon)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1564.001",
      "name": "Hide Artifacts: Hidden Files and Directories (Hiding the real folders)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1091",
      "name": "Replication Through Removable Media (USB worm propagation)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Instruct users to enable 'File name extensions' and 'Hidden items' in the Windows Explorer View tab; this instantly reveals the deception (e.g., 'Documents' becomes 'Documents.exe').",
    "Disable AutoRun and AutoPlay enterprise-wide via Group Policy for all removable media.",
    "Use EDR to track the execution chain; if a user executed a Fakefolder payload, you must identify what secondary malware it dropped on the system.",
    "Sanitize infected USB drives using the command prompt (`attrib -h -r -s /s /d drive_letter:\\*.*`) to unhide the legitimate folders, then delete the malicious executables."
  ],
  "what_to_avoid": [
    "Do not instruct users to simply format infected USB drives; their legitimate files are still there, they are just hidden by the malware.",
    "Avoid assuming this is a low-level threat; while the propagation method is old, the payload hidden behind the folder icon could be modern ransomware."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}