{
  "family": "trickster",
  "sample_count": 93,
  "category": "trojan",
  "description": "Trojan:Win32/Trickster is a deceptive trojan family that relies heavily on social engineering and 'scareware' tactics, often masquerading as a legitimate security update, Flash player, or system optimizer to trick users into executing the payload.<br><br><b>What is Trickster?</b><br>To the user, Trickster appears as a critical alert ('Your PC is infected!' or 'Video Codec Required'). For security analysts, Trickster is a generic dropper or potentially unwanted program (PUP) that utilizes highly deceptive UI patterns. Its primary goal is to establish a foothold on the system through user coercion rather than advanced software exploitation.<br><br><b>Infection Vectors & Threat Hunting</b><br>Trickster is primarily distributed via drive-by downloads from malicious advertising networks (malvertising) or bundled with pirated software. The initial executable is often digitally signed with a stolen or cheap certificate to bypass basic SmartScreen warnings. Upon execution, it establishes persistence via the Registry Run keys (`HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`). Once active, it frequently downloads secondary payloads—most commonly aggressive adware frameworks, browser hijackers, or fake antivirus software designed to extort money from the user.<br><br><b>Forensic Analysis & Impact</b><br>The impact ranges from severe endpoint bloat and privacy loss (adware) to potential financial fraud (scareware). Incident responders will notice the endpoint constantly displaying full-screen, unclosable alerts or aggressive pop-up advertisements. EDR logs will show the initial downloaded file attempting to spawn child processes to install the secondary toolbars and extensions. Network logs will show the software reaching out to affiliate payment portals or ad networks.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1491.001",
    "T1189",
    "T1105",
    "T1204.002",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1491.001",
      "name": "Defacement: Internal Defacement",
      "tactic": "Impact"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the continuous downloading of secondary payloads and the active exfiltration of telemetry.",
    "Audit the 'Add/Remove Programs' list and manually uninstall any fake optimizers, rogue AV, or unknown applications installed recently.",
    "Deploy an enterprise-grade adware removal tool to locate and strip the deep registry hooks, scheduled tasks, and forced browser policies.",
    "Educate the user on recognizing deceptive malvertising and fake software updates, emphasizing that legitimate software does not use high-pressure scare tactics."
  ],
  "what_to_avoid": [
    "Do not allow the user to pay for any 'premium' license offered by the fake software; it is an extortion scam.",
    "Avoid assuming the endpoint is clean simply because the AV quarantined the initial installer; the user likely already executed it."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}