Fakefolder

Overview

Trojan:Win32/Fakefolder (or generic **Folder Icon Spoofing** heuristics) represents a classic, yet highly effective social engineering tactic utilized primarily by USB worms and specific trojans. The malware deliberately changes its executable icon to match the standard yellow Windows Folder icon and hides the actual legitimate directories. The goal is to trick a user into double-clicking what they believe is a folder, which instead executes the malicious payload.

Understanding Fakefolder Tactics
To an end-user, this attack is highly deceptive. They plug in a USB drive, see a folder named 'Documents' with the correct icon, and double-click it. For a security analyst, this represents a reliance on user deception (`T1036.004`) rather than complex exploits. While the delivery mechanism is simple, the payloads hidden behind the fake folder icon can range from massive botnets to severe ransomware.

Execution and Deception Mechanics
Fakefolder malware typically spreads via removable media (USB drives) (`T1091`) or network shares (`T1080`). Upon infecting a drive, the malware marks all existing legitimate folders as 'Hidden' and 'System' files (`T1564.001`), making them invisible to the default Windows Explorer view. It then copies its own malicious executable (`.exe`, `.vbs`, or `.scr`) to the root of the drive, renaming itself to match the names of the hidden folders. Crucially, it embeds the standard `shell32.dll` folder icon into its executable (`T1036.004`). When the victim double-clicks the 'folder' (`T1204.002`), the malware executes. To maintain the illusion, the malware will often simultaneously open a new Explorer window displaying the contents of the *actual* hidden folder, so the user never realizes they just ran an executable.

Indicators of Compromise & Impact
The primary impact is the execution of a secondary payload (often a worm that will continue to spread). The most glaring host-based IoC is the presence of executables (`.exe`) that share the exact names of directories on a USB drive or network share. A sudden spike in EDR alerts originating from executions on removable media (`D:\`, `E:\`) is a strong indicator of a Fakefolder worm outbreak.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1036.004: Monitor for executable files running from unusual paths or with deceptive names. Use EDR to detect process masquerading.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_FAKEFOLDER {
    meta:
        description = "Detects Fakefolder (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "fakefolder" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Fakefolder Activity
id: ca7b5c4d93cafebc75e0690392a1beef
status: experimental
description: Detects generic indicators of the fakefolder malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*fakefolder*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Instruct users to enable 'File name extensions' and 'Hidden items' in the Windows Explorer View tab; this instantly reveals the deception (e.g., 'Documents' becomes 'Documents.exe').
2. Disable AutoRun and AutoPlay enterprise-wide via Group Policy for all removable media.
3. Use EDR to track the execution chain; if a user executed a Fakefolder payload, you must identify what secondary malware it dropped on the system.
4. Sanitize infected USB drives using the command prompt (`attrib -h -r -s /s /d drive_letter:\*.*`) to unhide the legitimate folders, then delete the malicious executables.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not instruct users to simply format infected USB drives; their legitimate files are still there, they are just hidden by the malware.
2. Avoid assuming this is a low-level threat; while the propagation method is old, the payload hidden behind the folder icon could be modern ransomware.

References & External Analysis

• Search "fakefolder" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Donloz
• Wews
• Polycrypt
• Zerber
• Remoh

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/fakefolder.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.