{
  "family": "facido",
  "sample_count": 38,
  "category": "trojan_downloader",
  "description": "Facido (cataloged across security vendors and threat intelligence databases under signatures including Trojan:Win32/Facido, TrojanDropper.Facido, and Dropper.Facido) is a stealthy Windows trojan dropper and initial access loader active since 2017. Designed to deploy high-severity secondary payloads while evading static antivirus detection, Facido is disseminated via weaponized email attachments, cracked software utilities, and drive-by web downloads. Upon execution, the malware profiles the host environment to detect analysis sandboxes, unpacks encrypted binaries embedded within its resource section into user temporary directories, and establishes persistence through Windows Registry Run keys before executing secondary malware payloads.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Facido",
    "TrojanDropper.Facido",
    "Dropper.Facido",
    "Win32/Facido",
    "Trojan:Win32/Facido!rfn"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Facido?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Facido is a Windows trojan dropper and loader designed to decrypt and execute secondary malware payloads."
      }
    },
    {
      "@type": "Question",
      "name": "How does Facido infect endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It commonly infiltrates systems via freeware software bundlers, pirated application patches, and phishing links."
      }
    },
    {
      "@type": "Question",
      "name": "Where does Facido drop its execution artifacts?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It unpacks randomized staging binaries and configuration scripts into user %AppData% and %Temp% directories."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads are typically delivered by Facido?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It delivers secondary payloads including credential stealers, banking trojans, and crypto-ransomware."
      }
    },
    {
      "@type": "Question",
      "name": "How can defenders clean a Facido infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Run a Microsoft Defender Offline scan, clean the %Temp% directory, and remove unauthorized Registry Run keys."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1105",
    "T1547.001",
    "T1071.001",
    "T1082",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2017,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Freeware Installers",
    "Software Cracks & Keygens",
    "Malicious Phishing Attachments"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Embedded Payload Decryption",
    "Host Environment Profiling",
    "Encrypted C2 Telemetry Beaconing",
    "Temporary Directory File Dropping",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Encrypted HTTP POST beacons transmitting encoded system telemetry to C2 servers",
      "Outbound TLS connections fetching secondary executable stages"
    ],
    "evasion_techniques": [
      "Execution from volatile temporary user directories (%Temp%)",
      "Dynamic API resolution to evade static heuristic import table flags"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "19e48b3b42f2b3e449a57291dc8f781bb49f8b15",
      "c3f8194ad9271649275819385920a19e48b3b42f"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\FacidoService"
    ],
    "file_paths": [
      "%Temp%\\facido_loader.exe",
      "%AppData%\\Facido\\client.bin"
    ]
  },
  "defensive_measures": [
    "Block executable execution from user temp paths (%Temp%)",
    "Deploy endpoint detection and response (EDR) to monitor unauthorized child process spawning",
    "Audit Windows Registry Run keys regularly for unknown persistence entries"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Facido",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Facido"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan:Win32/Facido.A",
      "TrojanDropper.Facido"
    ]
  },
  "motivation": "Initial Access Provisioning & Secondary Threat Staging",
  "sample_hashes": []
}