{
  "family": "feebs",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nFeebs is a highly destructive and self-replicating polymorphic Worm and Trojan that gained significant notoriety in the mid-2000s. Designed to rapidly propagate via mass-mailing techniques and peer-to-peer networks, Feebs severely degrades network performance and compromises endpoint security. Its defining characteristic is its aggressive polymorphism, constantly altering its code structure to evade traditional, signature-based antivirus detection.\n\n<h3>Propagation and Execution Lifecycle</h3>\nFeebs relies on aggressive, largely automated propagation techniques:\n<ul>\n<li><strong>Mass-Mailing (Worm Capability):</strong> Upon execution, Feebs harvests email addresses from the victim's local files (address books, cached web pages, document files). It then utilizes its own built-in SMTP engine to spam copies of itself to those addresses, spoofing the \"From\" address to increase the likelihood the recipient will open the malicious attachment (often a ZIP file containing a disguised executable or `.scr` file).</li>\n<li><strong>Polymorphism:</strong> Every time Feebs sends a copy of itself, it alters its internal code structure and encrypts its payload differently. This ensures that the file hash is completely unique for every single victim, rendering static AV signatures useless.</li>\n<li><strong>System Sabotage:</strong> Once active, Feebs attempts to disable local antivirus and firewall software, modifies the Windows `HOSTS` file to block access to security vendor websites, and drops secondary trojans or backdoors to allow the attacker persistent access.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Feebs infection is a major security incident. Its mass-mailing behavior can rapidly overwhelm corporate mail servers, resulting in denial-of-service conditions and severe IP reputation damage (getting the organization blacklisted by spam filters). Furthermore, its ability to disable local security controls leaves the endpoint vulnerable to further exploitation.\n\n<h3>Eradication and Incident Response</h3>\n<ul>\n<li><strong>Aggressive Network Isolation:</strong> Infected machines must be immediately disconnected from the LAN to halt the outbound spam traffic and prevent lateral spread via network shares.</li>\n<li><strong>Mail Gateway Filtering:</strong> Implement aggressive filtering at the Secure Email Gateway (SEG) to block inbound and outbound executable attachments, even within ZIP archives.</li>\n<li><strong>Behavioral EDR:</strong> Because Feebs is highly polymorphic, defenses must rely on heuristic and behavioral EDR tools that detect its anomalous actions (e.g., an unknown process attempting to establish SMTP connections or modifying the `HOSTS` file).</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Worm.Win32.Feebs",
    "W32/Feebs",
    "Trojan.Feebs"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566.001",
    "T1562.001",
    "T1562.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T16:46:31Z",
  "type": "Worm",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}