FakeTC malware family
FakeTC is a malware family tracked by MalwareAnalyzer by Cyble across 4 publicly analyzed samples. First seen 2026-07-31, most recently 2026-07-31. Observed ATT&CK techniques include T1056.001, T1112.
Corpus statistics
- Publicly analyzed samples: 4
- First seen: 2026-07-31
- Last seen: 2026-07-31
- Verdicts: malicious 4
- File types: pe 4
ATT&CK techniques used by FakeTC
Extracted command-and-control infrastructure
- http://www.truecrypt - 4 samples
- http://www.truecrypt.org/ - 4 samples
- http://www.truecrypt.org/docs/?s=troubleshooting - 4 samples
Recent FakeTC samples
- 544_PotaoExpress.bin - malicious (2026-07-31)
- 546_PotaoExpress.bin - malicious (2026-07-31)
- 547_PotaoExpress.bin - malicious (2026-07-31)
- Potao_FakeTrueCryptSetup_CFC8901FE6A9A8299087BFC73AE8909E - malicious (2026-07-31)
Frequently asked about FakeTC
- What is FakeTC?
- FakeTC is a malware family tracked by MalwareAnalyzer by Cyble across 4 publicly analyzed samples. First seen 2026-07-31, most recently 2026-07-31. Observed ATT&CK techniques include T1056.001, T1112.
- How many FakeTC samples have been analyzed?
- MalwareAnalyzer by Cyble holds 4 publicly analyzed samples attributed to FakeTC, first seen 2026-07-31 and most recently 2026-07-31. This counts public submissions to this platform only, so it is a measure of what we have seen rather than of the family's total prevalence.
- What MITRE ATT&CK techniques does FakeTC use?
- Across our FakeTC samples the most frequently observed techniques are T1056.001 (4), T1112 (4). Counts are the number of analyzed samples in which each technique was observed.
- What file types does FakeTC use?
- FakeTC samples in this corpus are distributed as pe (4).
- Does FakeTC use command-and-control infrastructure?
- Yes. 3 distinct command-and-control indicators have been extracted from FakeTC samples, either from static configuration or from traffic captured during sandbox detonation. The full list is published on the family page.
- Is FakeTC malicious?
- 4 of 4 analyzed FakeTC samples were scored malicious by the fused verdict, which combines multi-engine static scanning, YARA and hash reputation with behavior captured during real sandbox detonation. Each report lists every signal that contributed to its score.
Latest analyzed threats · ATT&CK coverage across the corpus · Threat trends