{
  "family": "fraudrop",
  "sample_count": 18,
  "category": "downloader",
  "description": "Fraudrop (cataloged across security software under designations including TrojanDropper:Win32/Fraudrop, Trojan:Win32/Fraudrop, and TrojanDropper.Fraudrop) is an obfuscated multi-stage Windows trojan dropper and malware distribution framework active in cybercriminal affiliate networks. Fraudrop is distributed primarily through deceptive software repacks, fake game cracks, and malicious download aggregators. Upon execution, Fraudrop conducts anti-debugging and sandbox evasion checks (verifying system memory, CPU core counts, and mouse movement). It drops secondary payloads (including infostealers, banking trojans, and crypto-ransomware) from encrypted resource sections into AppData or Temp directories, launching them using process hollowing or direct API calls (CreateProcessW). It configures persistence via Windows registry Run keys (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) to re-execute stagers upon reboot.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "TrojanDropper:Win32/Fraudrop",
    "Trojan:Win32/Fraudrop",
    "Win32/Fraudrop",
    "TrojanDropper.Fraudrop",
    "Fraudrop Stager"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is TrojanDropper:Win32/Fraudrop?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Fraudrop is an obfuscated trojan dropper that extracts and executes secondary malware payloads on infected Windows systems."
      }
    },
    {
      "@type": "Question",
      "name": "How does Fraudrop deliver secondary malware payloads?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It decrypts embedded executables stored within its PE resource sections and executes them using process hollowing or CreateProcessW."
      }
    },
    {
      "@type": "Question",
      "name": "How is Fraudrop distributed to victim endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled into fake software updates, deceptive freeware packages, and malicious software cracking archives."
      }
    },
    {
      "@type": "Question",
      "name": "How does Fraudrop maintain persistence across system reboots?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It configures Windows registry Run entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run."
      }
    },
    {
      "@type": "Question",
      "name": "What are the recommended remediation actions for Fraudrop?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the endpoint, terminate dropped malicious processes, delete startup registry entries, and run a comprehensive antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1027.002",
    "T1055.012",
    "T1547.001",
    "T1497",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2017,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Software Cracks and Keygens",
    "Fake Browser and Software Updates",
    "Malicious Download Aggregators"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Encrypted Payload Extraction & Staging",
    "Process Hollowing & Memory Injection",
    "Anti-Analysis & Sandbox Evasion Checks",
    "Autostart Registry Run Key Persistence",
    "Secondary Payload Downloading over HTTP"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable"
    ],
    "network_signatures": [
      "HTTP GET requests downloading encrypted secondary payload binaries from attacker servers",
      "Beacon traffic reporting host installation identifiers to remote C2"
    ],
    "evasion_techniques": [
      "Storing secondary binaries inside encrypted and compressed PE resource sections",
      "Sleep timers and user activity verification to defeat automated sandbox analysis"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f",
      "9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\FraudropStager"
    ],
    "file_paths": [
      "%AppData%\\Fraudrop\\dropper.exe",
      "%LocalAppData%\\Temp\\payload.exe"
    ]
  },
  "defensive_measures": [
    "Implement endpoint application whitelisting and restrict software execution from Temp and AppData directories",
    "Deploy endpoint detection and response (EDR) rules detecting process hollowing and unusual child process spawning",
    "Educate users to avoid downloading cracked software or unverified installers from third-party sites"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - TrojanDropper:Win32/Fraudrop",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDropper:Win32/Fraudrop"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - TrojanDropper.Win32.Fraudrop",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "TrojanDropper:Win32/Fraudrop.A",
      "TrojanDropper:Win32/Fraudrop.B"
    ]
  },
  "attack_stage": [
    "initial_access",
    "execution",
    "defense_evasion",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Secondary Payload Delivery & System Compromise",
  "sample_hashes": []
}