Filerepmalware
Table of Contents
Overview
FileRepMalware (identified across endpoint security platforms and telemetry as Win32:FileRepMalware [Trj], FileRepMalware [PUP], and Win64:FileRepMalware) is a widely encountered cloud reputation and heuristic detection signature established by Avast and AVG security engines. Triggered when an executable demonstrates a low prevalence score, lacks recognized digital code-signing certificates, and exhibits behavioral indicators common to trojans, downloaders, or potentially unwanted programs (PUPs), FileRepMalware acts as an automated triage shield against zero-day crimeware. Threats categorized under FileRepMalware span freshly compiled malware droppers, trojanized utility installers, unauthorized cryptocurrency miners, and ad injection stubs that attempt to slip past static signature databases by frequently altering binary hashes.
Known aliases
Threat reports may refer to this family under multiple names:
Family Pedigree & Lineage
Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:
Known Derivatives & Downstream Variants: Win32:Filerepmalware [Trj] · Filerepmalware [Pup] · Win64:Filerepmalware
MITRE ATT&CK Techniques
This family has been observed using the following ATT&CK techniques: T1204.002 · T1027 · T1547.001 · T1071.001 · T1082
Tactical Mitigations
Based on the techniques used by this family, consider the following defensive strategies:
- T1071.001: Implement web filtering and SSL/TLS inspection to detect malicious command and control (C2) traffic hiding in HTTP/HTTPS.
MITRE D3FEND™ Defensive Countermeasures
Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):
| D3FEND ID | Countermeasure Name | Tactic | Countered ATT&CK | Defensive Guidance |
|---|---|---|---|---|
D3-BDA | Binary De-obfuscation & Unpacking | Analyze | T1027 | Utilize memory dump scanners and entropy inspection to unpack encrypted stagers during process creation. |
D3-WAF | Web Content Filtering & Inspection | Filter | T1071.001 | Block newly registered domains (NRDs) and inspect HTTP Host and URI headers for known C2 profiles. |
D3-SDA | System Discovery Analysis | Detect | T1082 | Alert on rapid enumerations of systeminfo, hostname, and registry hardware trees in short intervals. |
D3-FEA | File Execution Analysis | Harden | T1204.002 | Enforce AppLocker and Windows Defender Application Control (WDAC) to block executable launches from temporary and user-writable directories. |
D3-RPM | Registry Persistence Monitoring | Detect | T1547.001 | Audit and restrict write privileges to user and machine-level Registry Run/RunOnce keys using Endpoint Privilege Management. |
Tiered Detection Rules (Cisco CAIRN Model)
Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:
Tier 1 Primitive Artifact Rule (Fast Triage)
Matches raw strings and file markers. Vulnerable to binary repacking and simple obfuscation.
rule MALWARE_WIN_FILEREPMALWARE_T1_ARTIFACT {
meta:
description = "Tier 1 Primitive Artifact: Raw string matches for Filerepmalware"
tier = "T1 - Primitive Artifact"
confidence = "Low-Medium (Fast Triage)"
author = "SystemHelpdesk Threat Research Desk"
date = "2026-10-14"
strings:
$s1 = "filerepmalware" ascii wide nocase
$s2 = "win32:filerepmalware [trj]" ascii wide nocase
$s3 = "filerepmalware [pup]" ascii wide nocase
$s4 = "win64:filerepmalware" ascii wide nocase
$s5 = "filerepmalware" ascii wide nocase
$s6 = "win32:filerepmalware" ascii wide nocase
condition:
uint16(0) == 0x5a4d and any of them
}Tier 2 Behavioral Context Rule (Process Chains & Sigma)
Tracks parent-child process anomalies and suspicious scripting telemetry. Resilient against file renames.
title: SystemHelpDesk Detection - Filerepmalware (Trojan) Execution & Triage
id: 3b40d61a-308f-5f53-b4be-e5b176766c25
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
with the Filerepmalware malware family. Detects suspicious execution from temporary
user directories with hidden window flags and background transfer utilities.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/filerepmalware
- https://malware-families-catalog.systemhelpdesk.com/defensive/downloader-dropper-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.trojan
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1204_002
- attack.t1027
- attack.t1547_001
- attack.t1071_001
- attack.t1082
logsource:
category: process_creation
product: windows
detection:
selection_process:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \cscript.exe
- \wscript.exe
CommandLine|contains:
- AppData\Local\Temp
- -WindowStyle Hidden
- /e:jscript
- bitsadmin /transfer
condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: mediumTier 3 Attribution Fingerprint Rule (High Fidelity)
Deep signature matching distinctive operational fingerprints and payload characteristics.
rule MALWARE_WIN_FILEREPMALWARE_T3_ATTRIBUTION {
meta:
description = "Tier 3 Attribution Fingerprint: Heuristic detection for Filerepmalware tradecraft"
tier = "T3 - Attribution Fingerprint"
confidence = "High (Confirmed Family Signature)"
author = "SystemHelpdesk Threat Research Desk"
date = "2026-10-14"
strings:
// Core family identifier & heuristic payload signatures
$attrib_str = "filerepmalware" ascii wide nocase
$pe_magic = "MZ" ascii
$net_marker = "http" ascii nocase
condition:
uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}References & External Analysis
Frequently Asked Questions
What is FileRepMalware in Avast and AVG?
FileRepMalware (short for File Reputation Malware) is an automated detection tag generated by the cloud reputation engines of Avast, AVG, and related antimalware scanners. Rather than identifying a specific, known virus signature, it flags executable files that are relatively new, rarely encountered in their global telemetry, or lack a trusted digital signature from an established software publisher.
Is FileRepMalware dangerous or safe?
FileRepMalware is a precautionary warning that a file is suspicious, but it does not definitively prove the file is dangerous. In many cases, it is a false positive triggered when a user downloads a brand-new software release, an indie game patch, or a custom script that hasn't yet built a reputation score. However, because cybercriminals frequently recompile malware binaries to evade signature detection, treat any unrecognized file flagged as FileRepMalware as potentially hazardous until verified.
Is FileRepMalware a false positive?
Yes, FileRepMalware has a relatively high false positive rate compared to traditional signature detections. It commonly triggers on legitimate newly compiled software, internal company utilities, open-source projects, and automated updates that have only been downloaded by a few users worldwide.
How do I know if a FileRepMalware detection is real malware or a false alarm?
Upload the quarantined or flagged file to VirusTotal.com to scan it across 70+ independent antivirus engines. If only Avast and AVG flag it as FileRepMalware while Microsoft Defender, Bitdefender, Kaspersky, and Sophos classify it as clean, it is almost certainly a reputation-based false positive. If multiple vendors flag it with specific trojan or stealer signatures, it is malicious.
How can I safely restore a file blocked as FileRepMalware?
If you have verified the file is clean via VirusTotal, open your antivirus Quarantine (Virus Chest), right-click the blocked executable, select 'Restore and add exception', and submit the file to the vendor's false positive analysis portal so it can be whitelisted for other users.
How does an antivirus engine calculate file reputation?
File reputation engines assess multiple telemetry criteria, including file age (how long the hash has existed on the internet), distribution volume (how many endpoints have downloaded it), download origin (trusted CDN vs. unverified file-sharing host), and the presence of a valid Extended Validation (EV) code-signing certificate.
How can software developers prevent their applications from being flagged as FileRepMalware?
Developers should sign all binaries and installers with an EV Code Signing Certificate, establish download volume over time, avoid packing executables with aggressive obfuscators like UPX or Themida, and proactively submit new software builds to major antivirus false positive analysis programs prior to public distribution.
How do I remove Filerepmalware from Windows?
Manual removal of Filerepmalware is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.
What are the main symptoms of a Filerepmalware infection?
Symptoms of Filerepmalware can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.
Protect Your Network Against Trojans
Want to prevent Filerepmalware and similar threats from compromising your organization? Read our comprehensive defensive guide: Banking Trojan Protection for Businesses.
📣 Threat Intel Correction or Update?
Notice an outdated IOC, unlisted alias, or disputed attribution? Threat researchers are invited to propose an update on GitHub or contact the SystemHelpDesk research desk. All community revisions are credited in our public CHANGELOG.
Machine-readable
Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/filerepmalware.json
Ecosystem & Interactive Environments
This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.