{
  "family": "installflash",
  "sample_count": 3,
  "category": "trojan",
  "description": "Trojan:Win32/Installflash is a highly deceptive malware family that relies entirely on social engineering, specifically the technique of **Masquerading**. It disguises itself as a critical Adobe Flash Player update or installer. Its singular goal is to trick the user into granting it administrative execution privileges, bypassing User Account Control (UAC) through deception rather than exploiting a technical vulnerability.<br><br><b>Understanding Installflash</b><br>To an end-user, Installflash appears as a convincing, seemingly urgent web page warning that 'Your Flash Player is out of date' or 'Flash is required to view this content'. Despite Flash being deprecated, this lure remains remarkably effective. For a security analyst, Installflash represents a failure of user awareness training and relies on the user to manually authorize the malicious payload.<br><br><b>Execution and Masquerading Mechanics</b><br>Installflash is exclusively encountered during web browsing on compromised sites (drive-by downloads) or via aggressive malvertising (`T1189`). The initial payload is an executable named `install_flashplayer.exe` or `FlashUpdate.exe` (`T1036.005`). These files are given the legitimate Adobe Flash logo icon and are often signed with stolen or spoofed digital certificates (`T1036.001`). When the user runs the file, the UAC prompt appears, asking the user to grant administrative privileges (`T1204.002`). Once the user clicks 'Yes', the malware executes with high privileges, establishes persistence, and proceeds to download its true payload—often adware, crypto-miners, or more severe backdoors.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends on the secondary payload it downloads. Host-based IoCs include the presence of executables named `flashplayer` running from `Downloads` or `%Temp%` instead of legitimate Adobe directories. EDR telemetry will show these fake installers spawning suspicious child processes (like PowerShell) or dropping secondary executables. Network IoCs include DNS requests to known malware distribution domains.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1036.005",
    "T1204.002",
    "T1105",
    "T1189"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1036.005",
      "name": "Masquerading: Match Legitimate Name or Location (Spoofing Adobe Flash)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File (Tricking the user to run the fake update)",
      "tactic": "Execution"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Malvertising delivery)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Downloading the actual payload)",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint from the network to prevent the fake installer from downloading its secondary, more destructive payload.",
    "Identify the source of the fake update (e.g., the specific URL or malvertising campaign) and block it at the corporate web proxy.",
    "Analyze the dropped `install_flashplayer.exe` in a sandbox to determine exactly what secondary malware families it attempted to retrieve.",
    "Run a full system scan to remove the Installflash launcher and any payloads it successfully installed."
  ],
  "what_to_avoid": [
    "Do not assume the system is safe just because the user cancelled the UAC prompt *after* downloading it; the malicious executable is still on the disk.",
    "Avoid relying solely on file names or icons for detection; always verify the digital signature and hash."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}