{
  "family": "fakerean",
  "sample_count": 3,
  "category": "advanced_threat",
  "description": "Rogue:Win32/Fakerean is a highly deceptive piece of malware classified as **Fake Antivirus (FakeAV) or Scareware**. Its entire operational model relies on social engineering and intimidation. It masquerades as a legitimate Windows security scanner, bombarding the user with fabricated alerts of catastrophic malware infections to coerce them into paying for a useless 'premium' license to clean their system.<br><br><b>Understanding Fakerean (Scareware)</b><br>To an end-user, Fakerean is terrifying. It employs aggressive pop-ups, flashes red warning banners across the screen, and mimics the UI of real security tools (like Windows Defender) to convince the user their machine is hopelessly compromised. For an enterprise security team, Fakerean is a nuisance malware that exploits human psychology rather than sophisticated zero-day vulnerabilities. It degrades productivity and represents a successful phishing or malvertising attack.<br><br><b>Execution and Intimidation Mechanics</b><br>Fakerean is primarily distributed via drive-by downloads on compromised websites, malicious advertising networks (malvertising), or fake 'Flash Player update' lures (`T1189`, `T1204.002`). Upon execution, it establishes persistence via the Registry Run keys to ensure it launches automatically upon boot (`T1547.001`). To enforce the illusion of an infected system and force payment, Fakerean actively impairs the user's ability to fix the problem. It modifies registry policies to disable Task Manager (`taskmgr.exe`), the Registry Editor (`regedit.exe`), and often blocks the execution of real, legitimate antivirus software by terminating their processes (`T1562.001`). It then displays a full-screen, unclosable window demanding credit card payment to 'remove the 42 detected severe threats' (`T1491.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is financial loss (if the user pays) and total loss of productivity. Host-based IoCs are blatantly obvious: highly aggressive, non-standard 'antivirus' pop-ups, the inability to launch administrative tools, and EDR alerts for rapid registry modifications aimed at disabling system policies. Network IoCs include HTTP traffic to the rogue payment gateways.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1562.001",
    "T1491.001",
    "T1204.002",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1491.001",
      "name": "Defacement: Internal Defacement (Aggressive fake AV UI)",
      "tactic": "Impact"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Blocking Task Manager/AV)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Immediately boot the infected machine into 'Safe Mode' to prevent the Fakerean executable from launching and blocking remediation tools.",
    "Use offline scanners or a reputable enterprise EDR tool (while in Safe Mode) to identify and delete the Fakerean binary and its registry persistence keys.",
    "Use a tool like `gpupdate /force` or manually edit the registry to reverse the policies that disabled Task Manager and Regedit.",
    "If the user submitted payment, advise them to immediately contact their credit card provider to report the fraudulent transaction."
  ],
  "what_to_avoid": [
    "Do not allow users to input payment information; paying the ransom will not clean the machine and exposes financial data to criminals.",
    "Avoid trying to manually kill the process from the normal desktop environment, as Fakerean often actively monitors and blocks `taskkill` commands."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}