Fakefolder

Overview

Trojan:Win32/Fakefolder (or generic **Folder Icon Spoofing** heuristics) represents a classic, yet highly effective social engineering tactic utilized primarily by USB worms and specific trojans. The malware deliberately changes its executable icon to match the standard yellow Windows Folder icon and hides the actual legitimate directories. The goal is to trick a user into double-clicking what they believe is a folder, which instead executes the malicious payload.

Understanding Fakefolder Tactics
To an end-user, this attack is highly deceptive. They plug in a USB drive, see a folder named 'Documents' with the correct icon, and double-click it. For a security analyst, this represents a reliance on user deception (`T1036.004`) rather than complex exploits. While the delivery mechanism is simple, the payloads hidden behind the fake folder icon can range from massive botnets to severe ransomware.

Execution and Deception Mechanics
Fakefolder malware typically spreads via removable media (USB drives) (`T1091`) or network shares (`T1080`). Upon infecting a drive, the malware marks all existing legitimate folders as 'Hidden' and 'System' files (`T1564.001`), making them invisible to the default Windows Explorer view. It then copies its own malicious executable (`.exe`, `.vbs`, or `.scr`) to the root of the drive, renaming itself to match the names of the hidden folders. Crucially, it embeds the standard `shell32.dll` folder icon into its executable (`T1036.004`). When the victim double-clicks the 'folder' (`T1204.002`), the malware executes. To maintain the illusion, the malware will often simultaneously open a new Explorer window displaying the contents of the *actual* hidden folder, so the user never realizes they just ran an executable.

Indicators of Compromise & Impact
The primary impact is the execution of a secondary payload (often a worm that will continue to spread). The most glaring host-based IoC is the presence of executables (`.exe`) that share the exact names of directories on a USB drive or network share. A sudden spike in EDR alerts originating from executions on removable media (`D:\`, `E:\`) is a strong indicator of a Fakefolder worm outbreak.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1036.004: Monitor for executable files running from unusual paths or with deceptive names. Use EDR to detect process masquerading.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_FAKEFOLDER_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Fakefolder"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "fakefolder" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Fakefolder (Ransomware) Execution & Triage
id: 4836ebbe-bd7e-57ec-b95a-99ef06698753
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Fakefolder malware family. Detects volume shadow copy deletion, boot status
  tampering, and recovery inhibition characteristic of modern ransomware operations.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/fakefolder
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.ransomware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1204_002
- attack.t1564_001
- attack.t1091
- attack.t1036_004
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \vssadmin.exe
    - \wmic.exe
    - \wbadmin.exe
    - \bcdedit.exe
    CommandLine|contains:
    - delete shadows
    - shadowcopy delete
    - resize shadowstorage
    - recoveryenabled no
    - ignoreallfailures
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: critical

rule MALWARE_WIN_FAKEFOLDER_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Fakefolder tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "fakefolder" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Instruct users to enable 'File name extensions' and 'Hidden items' in the Windows Explorer View tab; this instantly reveals the deception (e.g., 'Documents' becomes 'Documents.exe').
2. Disable AutoRun and AutoPlay enterprise-wide via Group Policy for all removable media.
3. Use EDR to track the execution chain; if a user executed a Fakefolder payload, you must identify what secondary malware it dropped on the system.
4. Sanitize infected USB drives using the command prompt (`attrib -h -r -s /s /d drive_letter:\*.*`) to unhide the legitimate folders, then delete the malicious executables.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not instruct users to simply format infected USB drives; their legitimate files are still there, they are just hidden by the malware.
2. Avoid assuming this is a low-level threat; while the propagation method is old, the payload hidden behind the folder icon could be modern ransomware.

References & External Analysis

• Search "fakefolder" on VirusTotal (External Analysis)
• Search "fakefolder" on Any.Run (Sandbox Sandbox)
• Search "fakefolder" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Ransomware)

Explore other documented threats in the same operational category:

• Redgirl
• Adkubru
• Fantom
• Cebot
• Emudbot
• Betload
• Bluteal
• Perez

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/fakefolder.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.