Hoax

Overview

Hoax:Win32/Hoax is a broad heuristic classification applied by antivirus engines to identify deceptive software programs, commonly known as scareware, fake antivirus (Rogue AV), or tech support scams, which utilize psychological manipulation to extort money from users.

Understanding Hoax (Scareware)
To the end-user, a Hoax infection is terrifying. Their screen is locked with flashing, official-looking warnings claiming their computer is severely infected with hundreds of viruses or that illegal activity was detected. For security analysts, Hoax is a purely social engineering attack. The malware itself is often technically trivial; it does not actually encrypt files or steal data. Its sole purpose is to frighten the user into paying for a fake 'premium version' to remove the non-existent threats, or to call a fraudulent tech support hotline.

Execution and Evasion Strategies
Hoax software is typically distributed via malicious advertisements (malvertising), drive-by downloads, or bundled with pirated software. Upon execution, it aggressively modifies the user interface. It may replace the desktop wallpaper, disable the Task Manager (`T1562.001`) to prevent the user from closing the fake warnings, and add persistence via the Registry Run keys. It continuously displays fraudulent scanning progress bars and exaggerated threat counts (`T1491`). The software is designed to be highly visible and difficult for a layperson to terminate.

Indicators of Compromise & Impact
The primary impact is financial loss if the user falls for the scam, and significant helpdesk ticket volume. Incident responders will observe a machine flooded with intrusive, fake UI elements. EDR logs will show the executable aggressively modifying registry keys designed to restrict user actions (e.g., `DisableTaskMgr`, `DisableRegistryTools`). Unlike true ransomware, the files on the hard drive remain unencrypted and accessible if the fake UI can be bypassed.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1059.003: Restrict execution of Windows Command Shell (cmd.exe) and block unauthorized batch scripts.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_HOAX {
    meta:
        description = "Detects Hoax (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "hoax" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Hoax Activity
id: 082856831ec22b63f594f61efb8d5d5e
status: experimental
description: Detects generic indicators of the hoax malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*hoax*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Quarantine the endpoint to prevent the Hoax software from communicating with its affiliate payment servers.
2. Boot the infected machine into Safe Mode; this often bypasses the persistence mechanisms of trivial scareware, allowing for manual removal.
3. Audit the Windows Registry and remove any policies designed to restrict user actions (e.g., restoring access to the Task Manager).
4. If the user provided credit card information to the fake software, advise them to contact their bank immediately to dispute the fraudulent charges.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not pay the requested fee; the software is fraudulent and the 'premium' version provides no actual security.
2. Avoid assuming the machine is clean just because the pop-ups stopped; the underlying adware framework must be fully uninstalled.

References & External Analysis

• Search "hoax" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Broduplo
• Belonard
• Wdjiange
• Donloz
• Ghoul

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/hoax.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.