{
  "family": "fuery",
  "sample_count": 28,
  "category": "trojan",
  "description": "Fuery (cataloged across endpoint security telemetry under signatures including Trojan:Win32/Fuery, Trojan:Win32/Fuery.A!cl, and Trojan.Fuery) is a prominent cloud-based heuristic detection by Microsoft Defender identifying stealthy polymorphic trojans, droppers, and backdoors active since 2017. Binaries flagged under the Fuery signature employ advanced evasive techniques such as process hollowing into svchost.exe, dynamic API resolution via PEB hashing, and anti-debugging checks to bypass static file scanners and automated sandbox analysis. Fuery droppers are frequently deployed in cybercrime campaigns to establish initial endpoint access, download secondary payloads (including information stealers and ransomware), and disable local security tools.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Fuery",
    "Trojan:Win32/Fuery.A!cl",
    "Trojan:Win32/Fuery.B!cl",
    "Win32/Fuery",
    "Trojan.Fuery"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Fuery?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Fuery is a Microsoft Defender cloud heuristic detection identifying evasive, polymorphic Windows trojans and initial access loaders."
      }
    },
    {
      "@type": "Question",
      "name": "What does the '!cl' suffix in Fuery.A!cl mean?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The '!cl' suffix denotes Cloud-based heuristic classification, where cloud telemetry identified malicious behavioral patterns in an unknown binary."
      }
    },
    {
      "@type": "Question",
      "name": "What malicious actions are performed by Fuery binaries?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Fuery binaries hollow code into svchost.exe, disable Windows Defender services, establish persistence, and download secondary payloads."
      }
    },
    {
      "@type": "Question",
      "name": "How is Fuery distributed to victim machines?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is delivered through malicious spam attachments, cracked software keygens, and exploit kit drive-by downloads."
      }
    },
    {
      "@type": "Question",
      "name": "How should an enterprise respond to a Fuery detection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the endpoint, check EDR logs for spawned child processes and hollowed svchost.exe instances, and conduct full remediation."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1055.012",
    "T1562.001",
    "T1105",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2017,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Weaponized Documents",
    "Trojanized Software Keygens",
    "Drive-by Download Exploits"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server"
  ],
  "capabilities": [
    "Process Hollowing into svchost.exe",
    "Dynamic API Resolution via PEB Hashing",
    "Security Control & Antivirus Impairment",
    "Secondary Payload Staging & Execution",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "In-Memory Shellcode Stager"
    ],
    "network_signatures": [
      "Encrypted HTTP/HTTPS beacons transmitting host telemetry to remote cloud infrastructure",
      "Outbound connections downloading XOR-encrypted secondary binary stagers"
    ],
    "evasion_techniques": [
      "Process hollowing into svchost.exe or explorer.exe to avoid creating new visible process trees",
      "Resolving all Windows APIs dynamically from the PEB export tables to evade import table detection"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "9ca3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1",
      "adb4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\FueryLoader",
      "HKCU\\Software\\Fuery"
    ],
    "file_paths": [
      "%Temp%\\fuery_stager.exe",
      "%AppData%\\Fuery\\loader.bin",
      "%LocalAppdata%\\Temp\\drop.exe"
    ]
  },
  "defensive_measures": [
    "Enable Cloud-delivered Protection and Automatic Sample Submission in Microsoft Defender Antivirus",
    "Deploy EDR with behavioral memory inspection to identify and block process hollowing into svchost.exe",
    "Block executable execution from user temporary locations (%Temp%, %AppData%) via AppLocker"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Fuery",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Fuery"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Fuery",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan:Win32/Fuery.A!cl",
      "Trojan:Win32/Fuery.B!cl"
    ]
  },
  "motivation": "Initial Access Provisioning, Defense Evasion & Crimeware Staging",
  "sample_hashes": []
}