Fakeransom

Overview

Ransomware:Win32/Fakeransom (or 'Scareware') refers to malicious programs that mimic the behavior and appearance of actual ransomware to extort money, but lack the capability to actually encrypt the victim's files (`T1491`). They rely entirely on psychological manipulation and screen-locking techniques rather than cryptographic damage.

Understanding Fakeransom (Scareware)
To an end-user, Fakeransom is terrifying. A full-screen window appears, claiming their files have been encrypted by a notorious cartel (like WannaCry or Ryuk) or locked by the FBI/Interpol for 'illegal activity', demanding immediate payment in Bitcoin or gift cards. For an incident responder, discovering the infection is 'fake' is a massive relief, as data recovery is usually trivial and requires no decryption key.

Execution and Screen-Locking Mechanics
Fakeransom is often distributed via malvertising, drive-by downloads, or bundled with pirated software. Upon execution, it does not encrypt files. Instead, it employs Screen Locking techniques (`T1491.002`). It maximizes a borderless window, sets it to always be 'on top', and disables the Task Manager (`taskmgr.exe`), the Windows key, and Alt+Tab functionality via API hooking (`T1562.001`). This traps the average user on the extortion screen, convincing them that their machine is hopelessly compromised.

Indicators of Compromise & Impact
The impact is psychological distress and potential financial loss if the user pays the ransom. Data availability is only temporarily affected by the screen lock. Host-based IoCs include the presence of the full-screen extortion window, registry modifications disabling the Task Manager (`DisableTaskMgr=1`), and a persistent executable running from `%AppData%` or `%Temp%`. Network IoCs may include connections to the attacker's payment portal, but unlike real ransomware, there is no transmission of encryption keys.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_FAKERANSOM {
    meta:
        description = "Detects Fakeransom (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "fakeransom" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Fakeransom Activity
id: 0624cc8f88da4fbcb49497c98a51f929
status: experimental
description: Detects generic indicators of the fakeransom malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*fakeransom*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Boot the infected computer into 'Safe Mode with Command Prompt' to bypass the screen-locking application.
2. Use the command prompt to launch `regedit.exe` and remove the persistence mechanism (usually a Run key) and re-enable the Task Manager.
3. Delete the Fakeransom executable from the file system.
4. Run a comprehensive anti-malware scan to ensure no other, silent threats were dropped alongside the scareware.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Under no circumstances should the ransom be paid; the files are not encrypted, and payment only encourages further extortion.
2. Avoid reinstalling the entire operating system, as this is usually unnecessary for non-encrypting scareware.

References & External Analysis

• Search "fakeransom" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Blouiroet
• Adylkuzz
• Rubinurd
• Nssm
• Xpyn

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/fakeransom.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.