Fakerean

Overview

Rogue:Win32/Fakerean is a highly deceptive piece of malware classified as **Fake Antivirus (FakeAV) or Scareware**. Its entire operational model relies on social engineering and intimidation. It masquerades as a legitimate Windows security scanner, bombarding the user with fabricated alerts of catastrophic malware infections to coerce them into paying for a useless 'premium' license to clean their system.

Understanding Fakerean (Scareware)
To an end-user, Fakerean is terrifying. It employs aggressive pop-ups, flashes red warning banners across the screen, and mimics the UI of real security tools (like Windows Defender) to convince the user their machine is hopelessly compromised. For an enterprise security team, Fakerean is a nuisance malware that exploits human psychology rather than sophisticated zero-day vulnerabilities. It degrades productivity and represents a successful phishing or malvertising attack.

Execution and Intimidation Mechanics
Fakerean is primarily distributed via drive-by downloads on compromised websites, malicious advertising networks (malvertising), or fake 'Flash Player update' lures (`T1189`, `T1204.002`). Upon execution, it establishes persistence via the Registry Run keys to ensure it launches automatically upon boot (`T1547.001`). To enforce the illusion of an infected system and force payment, Fakerean actively impairs the user's ability to fix the problem. It modifies registry policies to disable Task Manager (`taskmgr.exe`), the Registry Editor (`regedit.exe`), and often blocks the execution of real, legitimate antivirus software by terminating their processes (`T1562.001`). It then displays a full-screen, unclosable window demanding credit card payment to 'remove the 42 detected severe threats' (`T1491.001`).

Indicators of Compromise & Impact
The impact is financial loss (if the user pays) and total loss of productivity. Host-based IoCs are blatantly obvious: highly aggressive, non-standard 'antivirus' pop-ups, the inability to launch administrative tools, and EDR alerts for rapid registry modifications aimed at disabling system policies. Network IoCs include HTTP traffic to the rogue payment gateways.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_FAKEREAN {
    meta:
        description = "Detects Fakerean (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "fakerean" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Fakerean Activity
id: cc90491b6c60a5aeb6cde82617c69f3e
status: experimental
description: Detects generic indicators of the fakerean malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*fakerean*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately boot the infected machine into 'Safe Mode' to prevent the Fakerean executable from launching and blocking remediation tools.
2. Use offline scanners or a reputable enterprise EDR tool (while in Safe Mode) to identify and delete the Fakerean binary and its registry persistence keys.
3. Use a tool like `gpupdate /force` or manually edit the registry to reverse the policies that disabled Task Manager and Regedit.
4. If the user submitted payment, advise them to immediately contact their credit card provider to report the fraudulent transaction.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not allow users to input payment information; paying the ransom will not clean the machine and exposes financial data to criminals.
2. Avoid trying to manually kill the process from the normal desktop environment, as Fakerean often actively monitors and blocks `taskkill` commands.

References & External Analysis

• Search "fakerean" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Inbox
• Bandoo
• Pcacceleratepro
• Systimizer
• Simpleregistrycleaner

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/fakerean.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.