{
  "family": "fakecoder",
  "sample_count": 1,
  "category": "ransomware",
  "description": "Trojan:Win32/Fakecoder is a classic but enduring social engineering lure designed to trick users into executing malware under the guise of a required media player update. Attackers set up malicious streaming sites or seed torrents with video files that prompt the user to download a 'special codec' or 'video player update' to view the content. The downloaded file is, in fact, a trojan dropper (`T1204.002`).<br><br><b>Understanding Fakecoder (Social Engineering Delivery)</b><br>To an end-user, they are simply trying to watch a pirated movie, a sports stream, or adult content, and believe the prompt to update their software is legitimate. For a security team, a Fakecoder detection highlights a failure in user awareness training and a reliance on risky browsing behavior, providing a direct path for attackers to bypass email filters and network perimeters.<br><br><b>Execution and Delivery Mechanics</b><br>The attack relies heavily on user interaction. The victim navigates to a compromised site. The site uses JavaScript to detect the browser and serve a fake, highly realistic prompt (e.g., 'Flash Player is out of date' or 'Missing DivX Codec'). The user downloads the executable (often named `setup.exe` or `codec_pack.exe`) and runs it (`T1204.002`). The executable may actually install a basic media player to avoid suspicion, but silently drops a RAT, Adware, or Ransomware payload in the background (`T1027.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends on the secondary payload delivered by the fake codec. Host-based IoCs include the execution of unsigned executables from the `%Downloads%` folder immediately following web browsing activity to high-risk sites (streaming, torrents). EDR will flag the 'codec' installer spawning unexpected child processes (like `cmd.exe` or `powershell.exe`) to establish persistence or reach out to a C2 server.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Fakecoder and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Fakecoder is classified as a Ransomware. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Fakecoder establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Fakecoder typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Fakecoder compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Fakecoder should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What cryptographic algorithms and file targeting techniques does Fakecoder employ during execution?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Fakecoder typically leverages hybrid cryptographic architectures combining symmetric stream or block ciphers (such as AES-256 or ChaCha20) for rapid file encryption with asymmetric algorithms (such as RSA-2048 or Curve25519) to securely protect the session keys. It aggressively targets sensitive file extensions including corporate documents, databases, virtual disks, and backups while systematically executing commands to delete Volume Shadow Copies (vssadmin delete shadows /all /quiet) and disable system recovery options."
      }
    },
    {
      "@type": "Question",
      "name": "Are decryptors available for Fakecoder, and what is the recommended recovery procedure?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Decryption availability for Fakecoder depends on whether security researchers or law enforcement (such as the No More Ransom initiative) have recovered the master private keys or discovered flaws in its key generation routines. Victims should never pay the extortion demand, as payment fuels criminal operations without guaranteeing file restoration. The recommended recovery procedure entails isolating infected hosts, conducting forensic disk imaging, identifying the root access vector, and restoring validated systems from immutable offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1027.002",
    "T1204.002",
    "T1189"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File (The core of the attack relies on tricking the user into running the file)",
      "tactic": "Execution"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise (The malicious sites used to serve the fake prompts)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027.002",
      "name": "Obfuscated Files or Information: Software Packing (Hiding the malware inside the fake installer)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the machine; the fake codec was likely a dropper for a more severe payload (like an InfoStealer).",
    "Review web proxy logs for the infected host to identify the malicious streaming or download site, and block it enterprise-wide.",
    "Determine what the secondary payload was by analyzing the EDR process tree spawned by the downloaded executable.",
    "Conduct targeted security awareness training focusing on the dangers of pirated media and fake update prompts."
  ],
  "what_to_avoid": [
    "Do not close the incident just because the AV blocked the initial download; the user's risky browsing behavior needs to be addressed.",
    "Avoid allowing standard users to execute unapproved binaries from their `%Downloads%` folder (enforce AppLocker)."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}