{
  "family": "fraudload",
  "sample_count": 25,
  "category": "trojan_downloader",
  "description": "FraudLoad (cataloged across security intelligence feeds under signatures including TrojanDownloader:Win32/FraudLoad, Trojan.FraudLoad, and Trojan-Downloader.Win32.FraudLoad) is a historic family of trojan downloaders active from 2009 to 2014, specifically created to deliver rogue security software and scareware (such as FakeVimes, Antivirus Pro, Winwebsec, and Desktop Defender). Distributed via Black Hat SEO search poisoning, malicious video codecs, and fake online malware scanners, FraudLoad silently establishes an initial foothold on Windows systems. Once active, FraudLoad downloads the main scareware GUI payload, terminates legitimate antivirus software processes, and configures the rogue executable to launch on every Windows startup, initiating false infection alerts and extortion payment demands.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "TrojanDownloader:Win32/FraudLoad",
    "Trojan.FraudLoad",
    "Trojan-Downloader.Win32.FraudLoad",
    "Win32/FraudLoad",
    "FakeAV Loader"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is TrojanDownloader:Win32/FraudLoad?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "FraudLoad is a trojan downloader specifically engineered to download and install rogue antivirus (scareware) programs onto Windows computers."
      }
    },
    {
      "@type": "Question",
      "name": "What scareware families were delivered by FraudLoad?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "FraudLoad delivered infamous scareware suites including FakeVimes, Winwebsec, Antivirus Pro, and System Security."
      }
    },
    {
      "@type": "Question",
      "name": "How did FraudLoad infect victims?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through Black Hat SEO poisoning on popular search engines, fake online malware scanner popups, and trojanized video codecs."
      }
    },
    {
      "@type": "Question",
      "name": "How does FraudLoad impair system defenses?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It terminates processes belonging to legitimate antivirus suites and prevents legitimate antimalware updates by modifying DNS settings."
      }
    },
    {
      "@type": "Question",
      "name": "How was FraudLoad eradicated from infected computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Booting into Safe Mode with Networking, running specialized rogue removal tools (such as Malwarebytes), and resetting proxy settings."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1105",
    "T1562.001",
    "T1547.001",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2009,
  "threat_actor": null,
  "delivery_mechanism": [
    "Black Hat SEO Search Poisoning",
    "Fake Video Codec Prompts",
    "Deceptive Online Virus Scanner Popups"
  ],
  "target_platforms": [
    "Windows 7",
    "Windows Vista",
    "Windows XP"
  ],
  "capabilities": [
    "Automated Rogue Antivirus Payload Retrieval",
    "Antivirus Process Termination",
    "Windows Startup Run Key Manipulation",
    "Browser Proxy Configuration Hijacking",
    "Host Hardware & OS Profiling"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (C++)",
      "Configuration Script"
    ],
    "network_signatures": [
      "HTTP GET requests fetching executable scareware payloads from fast-flux bulletproof hosting domains",
      "Reporting installation success to cybercrime affiliate panels"
    ],
    "evasion_techniques": [
      "Terminating taskmgr.exe and known security binaries via taskkill or TerminateProcess",
      "Setting local proxy server to 127.0.0.1 to block external browser navigation to security sites"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "7be0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8",
      "8cf1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\FraudLoadAgent",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer"
    ],
    "file_paths": [
      "%AppData%\\FraudLoad\\loader.exe",
      "%Temp%\\fake_av_setup.exe"
    ]
  },
  "defensive_measures": [
    "Deploy secure web gateways to block malicious redirection networks and known rogue scareware distribution domains",
    "Enforce application control policies blocking unverified executables from running in user AppData directories",
    "Educate users that web browser pop-ups stating their computer is infected are fraudulent"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - TrojanDownloader:Win32/FraudLoad",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/FraudLoad"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.FraudLoad",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [
      "Winwebsec Rogue Security Syndicate"
    ],
    "variants": [
      "TrojanDownloader:Win32/FraudLoad.A",
      "TrojanDownloader:Win32/FraudLoad.B"
    ]
  },
  "motivation": "Financial Fraud, Scareware Coercion & Fake License Extortion",
  "sample_hashes": []
}