Fake AV is designed to fake three antivirus brands. Fake AV simulates the results of a malware search. Trojan dropper downloads the Fake GUI required by the scam. Fake antivirus is based on a dropper (Trojan.Win32.Scar.fdiz) Fake AV server is built with a rule:http://X.X/fakeav/interface.php?av=[Anti-Virus GUI name]&lang=en.html] Fake AV servers are based on files / brands on fake AV servers.”]
Source: https://securelist.com/choose-your-preferred-fake-av/31739/