{
  "family": "fuerboos",
  "sample_count": 110,
  "category": "trojan",
  "description": "Fuerboos (cataloged by Microsoft Defender as Trojan:Win32/Fuerboos, Trojan:Win32/Fuerboos!cl, Trojan:Win32/Fuerboos!MTB, and TrojanDownloader:Win32/Fuerboos, with related variants detected as Bearfoos) is a multi-stage Windows trojan and payload downloader active since 2016. Monitored through Microsoft's cloud-based heuristics engine (denoted by the !cl suffix), Fuerboos flags binaries exhibiting aggressive code packing, runtime obfuscation, and unauthorized system modifications. While frequently triggered as a false positive on custom-compiled developer utilities, self-extracting archive installers, and software wrappers requiring low-level Windows API hooking, genuine Fuerboos malware acts as an initial access broker and payload stager. In malicious campaigns, Fuerboos payloads are distributed via malvertising networks, fake browser update alerts, and deceptive software portals. Upon execution, the malware establishes registry run key persistence, disables security notifications, and initiates covert outbound HTTP connections to retrieve and execute secondary monetization modules, including silent click-fraud engines, browser hijackers, and rogue system cleaners.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Fuerboos",
    "Trojan:Win32/Fuerboos!cl",
    "Trojan:Win32/Fuerboos!MTB",
    "TrojanDownloader:Win32/Fuerboos",
    "Win32/Bearfoos"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Trojan:Win32/Fuerboos detection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Fuerboos is a Microsoft Defender heuristic detection identifying packed trojans and downloaders that stage secondary malware."
      }
    },
    {
      "@type": "Question",
      "name": "What does the '!cl' suffix mean in Fuerboos!cl?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The '!cl' suffix designates a cloud-based machine learning heuristic detection identifying rare or newly compiled suspicious files."
      }
    },
    {
      "@type": "Question",
      "name": "Why does Fuerboos frequently flag developer tools?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Because heuristic engines flag low-level API hooking, custom compilation wrappers, and runtime packing used by both tools and malware."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads are staged by Fuerboos?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Fuerboos typically downloads click-fraud modules, advertising hijackers, rogue PC optimizers, and information stealers."
      }
    },
    {
      "@type": "Question",
      "name": "How do administrators remediate a Fuerboos infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Quarantine the file, inspect recently dropped items in %Temp% and %AppData%, and run full multi-engine endpoint scans."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1105",
    "T1027",
    "T1189",
    "T1204.002",
    "T1547.001",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Quarantine the flagged executable immediately to prevent initialization of secondary download sequences.",
    "Inspect the Windows %Temp% and %AppData% directories for newly created unsigned binaries and delete staging files.",
    "Audit Registry Run keys and Task Scheduler for persistent entries referencing newly dropped executable paths.",
    "Verify the binary against VirusTotal to determine if the detection represents a cloud heuristic false positive."
  ],
  "what_to_avoid": [
    "Do not dismiss Fuerboos detections from untrusted downloads as mere false positives; verify origin and digital signatures.",
    "Avoid executing software wrappers and cracked utilities distributed through third-party download portals."
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Commercial Organizations",
    "Consumer Endpoints"
  ],
  "motivation": "Payload Delivery",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "defense_evasion",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2016,
  "lineage": {
    "derived_from": [
      "Cloud Heuristic Trojan Families"
    ],
    "variants": [
      "Fuerboos.A",
      "Fuerboos!cl",
      "Fuerboos!MTB",
      "Bearfoos.A"
    ]
  },
  "iocs": {
    "file_hashes": [
      "6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d",
      "7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e"
    ],
    "delivery": [
      "Malvertising campaigns and fake software update dialogs",
      "Deceptive repackaged installers and utility wrappers"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\FuerboosUpdate",
      "Scheduled Task launching secondary payload from %Temp%"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Fuerboos",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Fuerboos"
    },
    {
      "name": "PCRisk Threat Research - Trojan:Win32/Fuerboos Analysis",
      "url": "https://www.pcrisk.com/removal-guides/trojan-win32-fuerboos"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}