{
  "family": "fraudload",
  "sample_count": 25,
  "category": "trojan",
  "description": "TrojanDownloader:Win32/Fraudload is a specialized trojan explicitly designed to bypass security controls and forcibly download and install Rogue Security Software (Scareware) onto a victim's machine.<br><br><b>Understanding Fraudload</b><br>To the victim, a Fraudload infection is the terrifying precursor to a scareware attack. One moment the machine is fine, the next it is flooded with fake antivirus alerts claiming the system is critically infected. For security analysts, Fraudload acts as the stealthy delivery mechanism for the highly visible scareware payload. Its sole purpose is to get the fake AV (like Systemhealer or Winwebsec) onto the system without triggering actual antivirus software.<br><br><b>Execution and Evasion Strategies</b><br>Fraudload is frequently distributed via Malvertising (malicious ads injected into legitimate websites) or Drive-by Downloads (`T1189`). When a user visits a compromised site, an exploit kit silently executes the Fraudload binary. It uses obfuscation (`T1027`) to bypass static signatures. It rapidly establishes an HTTP connection to an affiliate tracking server (`T1105`) to pull down the scareware executable. It then establishes persistence (often via Registry Run keys) for the downloaded scareware and executes it (`T1204.002`). Fraudload frequently attempts to disable the Windows Security Center and local AV services (`T1562.001`) to ensure the scareware runs unhindered.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely compromised user experience and potential financial loss if the user pays the scareware ransom. EDR platforms will detect the Fraudload binary attempting to modify security service states or downloading unsigned executables into `%Temp%`. Network logs will show brief, encrypted connections to newly registered or suspicious domains immediately prior to the system being flooded with fake UI alerts.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1491",
    "T1105",
    "T1189",
    "T1027",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1491",
      "name": "Defacement",
      "tactic": "Impact"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint to prevent Fraudload from downloading further scareware modules or reporting telemetry back to the affiliate network.",
    "Boot the infected machine into Safe Mode; this often bypasses the persistence mechanisms of the downloaded scareware, allowing for manual removal.",
    "Audit the 'Add/Remove Programs' list and manually uninstall the scareware, as well as the initial Fraudload dropper.",
    "Ensure that local Windows Defender or corporate AV services have not been permanently disabled via Registry modifications."
  ],
  "what_to_avoid": [
    "Do not pay the requested fee displayed by the downloaded software; the software is fraudulent.",
    "Avoid assuming the machine is clean just because the pop-ups stopped; the underlying Fraudload dropper must be identified and removed."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}