Feebs

Category: trojan · Aliases: Worm.Win32.Feebs, W32/Feebs, Trojan.Feebs · Sample count (EMBER 2018): 1 · Enrichment: insufficient_information · Updated: 2026-07-01T16:46:31Z

Category: TrojanActor: Unknown / CybercriminalIndustry: Global / OpportunisticMotivation: Opportunistic

Overview

Executive Summary

Feebs is a highly destructive and self-replicating polymorphic Worm and Trojan that gained significant notoriety in the mid-2000s. Designed to rapidly propagate via mass-mailing techniques and peer-to-peer networks, Feebs severely degrades network performance and compromises endpoint security. Its defining characteristic is its aggressive polymorphism, constantly altering its code structure to evade traditional, signature-based antivirus detection.

Propagation and Execution Lifecycle

Feebs relies on aggressive, largely automated propagation techniques:

Mass-Mailing (Worm Capability): Upon execution, Feebs harvests email addresses from the victim's local files (address books, cached web pages, document files). It then utilizes its own built-in SMTP engine to spam copies of itself to those addresses, spoofing the "From" address to increase the likelihood the recipient will open the malicious attachment (often a ZIP file containing a disguised executable or `.scr` file).
Polymorphism: Every time Feebs sends a copy of itself, it alters its internal code structure and encrypts its payload differently. This ensures that the file hash is completely unique for every single victim, rendering static AV signatures useless.
System Sabotage: Once active, Feebs attempts to disable local antivirus and firewall software, modifies the Windows `HOSTS` file to block access to security vendor websites, and drops secondary trojans or backdoors to allow the attacker persistent access.

Threat Assessment

A Feebs infection is a major security incident. Its mass-mailing behavior can rapidly overwhelm corporate mail servers, resulting in denial-of-service conditions and severe IP reputation damage (getting the organization blacklisted by spam filters). Furthermore, its ability to disable local security controls leaves the endpoint vulnerable to further exploitation.

Eradication and Incident Response

Aggressive Network Isolation: Infected machines must be immediately disconnected from the LAN to halt the outbound spam traffic and prevent lateral spread via network shares.
Mail Gateway Filtering: Implement aggressive filtering at the Secure Email Gateway (SEG) to block inbound and outbound executable attachments, even within ZIP archives.
Behavioral EDR: Because Feebs is highly polymorphic, defenses must rely on heuristic and behavioral EDR tools that detect its anomalous actions (e.g., an unknown process attempting to establish SMTP connections or modifying the `HOSTS` file).

Known aliases

Threat reports may refer to this family under multiple names:

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1566.001 T1562.001 T1562.004

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_FEEBS {
    meta:
        description = "Detects Feebs (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "feebs" ascii wide nocase
        $s2 = "worm.win32.feebs" ascii wide nocase
        $s3 = "w32/feebs" ascii wide nocase
        $s4 = "trojan.feebs" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Feebs Activity
id: 0f991f506c91f39ecac6229ffe962972
status: experimental
description: Detects generic indicators of the feebs malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*feebs*"
            - "*worm.win32.feebs*"
            - "*w32/feebs*"
            - "*trojan.feebs*"
    condition: selection
level: medium

References & External Analysis

Search "feebs" on VirusTotal (External Analysis)

Frequently Asked Questions

How do I remove the Feebs Trojan from Windows?

Manual removal of Feebs is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.

Is Feebs a virus or a Trojan?

Feebs is classified as a Trojan. Unlike traditional viruses that infect files, modern malware like Feebs typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.

What are the main symptoms of a Feebs infection?

Symptoms of Feebs can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.

Related Families (Category: trojan)

Explore other malware families in the same category:

Protect Your Network Against Trojans

Want to prevent Feebs and similar threats from compromising your organization? Read our comprehensive defensive guide: Banking Trojan Protection.

Need help with an active incident? Published by the SystemHelpdesk team.

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/feebs.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.