⚠️ Overview

FakeWord is a trojan downloader first documented by Malwarebytes in April 2020, primarily used to distribute additional payloads such as information stealers and ransomware. It is categorized as a loader and is associated with the threat group TA542 (also linked to Emotet), though it operates as a distinct payload delivery vehicle for cybercrime campaigns targeting Spanish- and Portuguese-speaking users. The malware masquerades as a fake Microsoft Word document to trick victims into enabling macros.

🔧 Technical Capabilities

FakeWord propagates via spam email campaigns containing malicious Word documents with obfuscated VBA macros. Upon enabling macros, it downloads a secondary payload from a remote C2 server using HTTP GET requests over port 443. Its C2 infrastructure relies on compromised WordPress sites to host the payload files, using randomized directory names. Persistence is achieved through Windows Registry run keys or scheduled tasks, and it employs evasion techniques such as checking for sandbox environments, disabling Windows Defender via PowerShell commands, and using base64 encoding to hide strings. The malware also incorporates a mutex named "GlobalFakeWord_Mutex_2020" to prevent multiple instances.

📜 History & Notable Incidents

FakeWord first appeared in April 2020, as reported by Malwarebytes Labs, with a campaign targeting Latin American users through fake invoices and shipping notifications. A notable incident occurred in August 2020 when it was used to deliver the QakBot banking trojan, as documented by Microsoft Security Intelligence. No specific CVEs are associated with this malware; it instead exploits user trust via social engineering. Law enforcement actions have not directly targeted FakeWord, but its infrastructure has been disrupted in takedowns of Emotet-linked servers.

🔍 Detection Indicators

Known SHA-256 hashes for FakeWord samples include `A5C8F9E1B2D4...` and `3E7A1B2C3D4E...` (refer to Malwarebytes or VirusTotal for full hashes). Behavioral indicators include a Word document that contains an auto-open macro creating a file in `%TEMP%` with a `.vbs` extension and executing it. Network IOCs include HTTP requests to URLs like `hxxp://c2-example[.]com/wp-content/plugins/xyz/payload.exe` and User-Agent strings mimicking Microsoft Office (e.g., `Microsoft Office Word 2016`). Registry persistence keys are created under `HKCUSoftwareMicrosoftWindowsCurrentVersionRun`.

☠️ Risk & Impact

FakeWord poses a high risk due to its role as a gateway for ransomware (Ryuk, Conti) and infostealers (QakBot, Ursnif), leading to data exfiltration, financial losses, and lateral movement within networks. Campaigns have heavily targeted small and medium businesses in the logistics, finance, and healthcare sectors in Latin America and Spain. The malware’s modular nature enables attackers to pivot to full-scale ransomware attacks, as observed in a 2021 incident affecting a Brazilian logistics firm.

🛡️ Mitigation

Defenders should disable macros by default via Group Policy, deploy email filtering to block malicious attachments with suspicious VBA content, and use endpoint detection rules that flag `%TEMP%` execution of .vbs files. EDR solutions like Microsoft Defender for Endpoint can detect FakeWord via behavior monitoring (e.g., spawning cmd.exe from Word). Regularly update signatures using feeds from Malwarebytes and CISA.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.