{
  "family": "fraudpack",
  "sample_count": 17,
  "category": "exploit_kit",
  "description": "FraudPack (classified across antimalware research as Exploit:Win32/FraudPack, TrojanDownloader:Win32/FraudPack, and Exploit.FraudPack) is a notorious commercial web-based exploit kit and crimeware distribution package first identified in 2010. Sold on underground Russian-speaking cybercrime forums, FraudPack was designed to automate drive-by downloads on compromised websites. When an unsuspecting visitor lands on an infected webpage, FraudPack inspects the client browser User-Agent, operating system version, and installed third-party plugins (including Adobe Flash Player, Adobe Reader, Java Runtime Environment, and Microsoft Internet Explorer). It dynamically selects and serves weaponized browser and ActiveX exploits targeting known vulnerabilities (such as CVE-2010-0840 and CVE-2010-1885). Upon successful exploitation of memory or parsing bugs, FraudPack executes shellcode that downloads and launches secondary malware (such as Zeus banking trojans or fake antivirus scareware) silently in the background.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Exploit:Win32/FraudPack",
    "TrojanDownloader:Win32/FraudPack",
    "Win32/FraudPack",
    "FraudPack Exploit Kit",
    "FraudPack Crimeware"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Exploit:Win32/FraudPack?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "FraudPack is a commercial web exploit kit that targets browser and plugin vulnerabilities to deliver secondary malware via drive-by downloads."
      }
    },
    {
      "@type": "Question",
      "name": "How does FraudPack fingerprint visiting web browsers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It runs JavaScript routines to inspect User-Agent headers, browser architecture, and installed plugins (Java, Flash, PDF readers)."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary malware did FraudPack commonly deliver?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It commonly dropped Zeus banking trojans, rogue antivirus scareware, and credential-harvesting infostealers."
      }
    },
    {
      "@type": "Question",
      "name": "How do web users get exposed to FraudPack exploits?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Users encounter FraudPack when visiting legitimate websites that have been compromised with malicious hidden iframe injections."
      }
    },
    {
      "@type": "Question",
      "name": "How can organizations protect endpoints from web exploit kits like FraudPack?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Keep browsers and third-party software patched, disable legacy browser plugins (Flash, Java), and deploy web filtering gateways."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1189",
    "T1203",
    "T1059.007",
    "T1105",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2010,
  "threat_actor": null,
  "delivery_mechanism": [
    "Drive-by Downloads via Compromised Web Pages",
    "Malicious Hidden iframe Injections",
    "Malvertising Traffic Redirections"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Client Browser & Plugin Fingerprinting (JavaScript)",
    "Dynamic Exploit Selection & Payload Delivery",
    "Memory Corruption & ROP Chain Execution",
    "Silent In-Memory Shellcode Execution",
    "Secondary Malware Stager Downloading"
  ],
  "technical_analysis": {
    "file_types": [
      "HTML / JavaScript File",
      "SWF Flash Object",
      "Java Applet (.jar)",
      "Win32 PE Executable"
    ],
    "network_signatures": [
      "HTTP GET requests with obfuscated query parameters requesting exploit landing pages",
      "Binary downloads retrieving encrypted second-stage malware executables"
    ],
    "evasion_techniques": [
      "Heavily obfuscated JavaScript using string concatenation and eval()",
      "One-time IP address tracking to prevent repeated security scanner inspection"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "a1b2c3d4e5f60718293a4b5c6d7e8f9a0b1c2d3e",
      "b2c3d4e5f60718293a4b5c6d7e8f9a0b1c2d3e4f"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\FraudPackStager"
    ],
    "file_paths": [
      "%LocalAppData%\\Temp\\exploit.tmp",
      "%AppData%\\FraudPack\\loader.exe"
    ]
  },
  "defensive_measures": [
    "Deploy secure web gateways (SWG) that inspect and block known exploit kit landing domains",
    "Ensure automatic patching is enabled across all web browsers and operating system components",
    "Disable legacy browser extensions and NPAPI plugins across corporate workstations"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Exploit:Win32/FraudPack",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Exploit:Win32/FraudPack"
    },
    {
      "name": "Trend Micro Security Research - Analyzing FraudPack Exploit Kit Architecture",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Exploit:Win32/FraudPack.A",
      "Exploit:Win32/FraudPack.B"
    ]
  },
  "attack_stage": [
    "initial_access",
    "execution",
    "command_and_control"
  ],
  "ecosystem": [
    "windows_pe",
    "web_exploit"
  ],
  "is_emerging": false,
  "motivation": "Drive-by Exploitation & Crimeware Distribution",
  "sample_hashes": []
}