Fiber
Fiber is a .NET loader/injector used in multi-stage Windows malware delivery chains. In the provided reporting, it is extracted from steganographic image files and reflectively loaded into memory after an initial phishing-delivered script stage, making later stages largely fileless. Fiber is described as a PE32 .NET Framework 4.5 x86 DLL and as a loader identified from internal strings and the Fiber.Program entry point; one sample also contained the namespace HackForums.gigajew.
Observed infection chains begin with phishing or spearphishing attachments masquerading as business documents, including request-for-quote and product/pricing files implemented as obfuscated JScript. The script stage uses WMI Win32_Process.Create to launch hidden PowerShell, downloads a weaponized JPEG from attacker-controlled infrastructure, extracts encoded data between markers such as "IN-" and "-in1," transforms and base64-decodes it, and reflectively loads the Fiber assembly into memory. Fiber then downloads another steganographic image, extracts the next-stage payload from markers including "INICIO" and "FIM," and executes it.
Capabilities directly attributed to Fiber in the content include sandbox/VM detection, anti-debugging, persistence, staged payload retrieval, and process hollowing. VM and sandbox checks include WMI queries for VMware and VirtualBox artifacts and BIOS/virtual machine detection logic. Anti-debugging includes scanning process names for tools such as dnspy, vsdbg, de4dot, and debug. Persistence mechanisms reported for Fiber include dropping JavaScript files such as Q78BmqBbKP.js, creating scheduled tasks including "EmGqzwd3kD," and in another campaign using both a scheduled task and a Registry Run key. Execution techniques include use of signed Windows binaries such as CasPol.exe and, in another cluster, RegAsm.exe as hollowed host processes. Reported hollowing APIs include CreateProcess in suspended mode, ZwUnmapViewOfSection, VirtualAllocEx, WriteProcessMemory, GetThreadContext, SetThreadContext, and ResumeThread.
Fiber is associated in the content with delivery of multiple commodity malware families, including Formbook/XLoader, AsyncRAT, and njRAT/Bladabindi derivatives. In the Formbook/XLoader chain, Fiber was delivered from tradedsglobal.com via optimized_MSIlatino.png and then retrieved oboxload.png before hollowing the final payload into CasPol.exe. In the AsyncRAT chain, Fiber was delivered from a Cloudinary-hosted JPEG, downloaded a further stage from 91.92.242.219, used CasPol.exe as a LOLBIN, and supported persistence via scheduled task and Registry Run key before launching an AsyncRAT variant. In the GoLoader-related activity, Fiber was extracted from steganographic carriers in Alibaba Cloud OSS-hosted campaigns and used to hollow njRAT into RegAsm.exe.
Targeting reflected in the content includes procurement, manufacturing, and engineering personnel via business-themed lures, as well as cryptocurrency investors via Simplified Chinese lure content. Language and attribution artifacts mentioned in the reporting include Brazilian Portuguese strings such as "Erro ao iniciar via WMI. Código:" and marker strings "INICIO"/"FIM," and a separate sample containing the namespace HackForums.gigajew, assessed by the source report as an attribution clue tied to the handle "gigajew." High-confidence infrastructure and indicators mentioned for Fiber-related delivery include tradedsglobal.com, Cloudinary account dn6bpc2yo, 91.92.242.219, and Alibaba Cloud OSS bucket jpginfo. Sample hashes explicitly associated with Fiber include 9da3fba7b57421476f3e6e44d0d9c800f6678c845d1b8e83864e219b6c6ae178 and 240068f98bd3e3213351ebdac3a0e9657f9a17506e43425ea3ed19f14e17cf21.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
21 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
4 techniques
Execution
Persistence
2 techniques
Persistence
Privilege Escalation
3 techniques
Privilege Escalation
Stealth
11 techniques
Stealth
A phishing email attachment disguised as a request-for-quote (RFQ 11062026.js) is a heavily-obfuscated JScript dropper.
The 93 PNG files in the bucket are steganographic carriers... the PE payload is appended after the JPEG end-of-file marker ( FF D9 ).
A phishing email attachment disguised as a request-for-quote (RFQ 11062026.js)
The _pdf suffix before .js is a classic double-extension trick designed to fool users who have file extensions hidden in Windows Explorer.
RunPE / process hollowing into CasPol.exe CreateProcess(SUSPENDED) → ZwUnmapViewOfSection → VirtualAllocEx → WriteProcessMemory → GetThreadContext/SetThreadContext → ResumeThread
carve bytes between markers INICIO ... FIM ; transform '#'→'A' , reverse, Base64-decode
process-hollows Formbook into the signed Windows binary CasPol.exe
VirtualMachineDetector (WMI: vmware/vbox/etc.) → bail if VM
The VirtualMachineDetector class queries BIOS characteristics via WMI to detect virtualized environments ... If the environment appears to be a sandbox or VM, the loader can terminate early
Discovery
3 techniques
Discovery
VirtualMachineDetector (WMI: vmware/vbox/etc.) → bail if VM
IOCs tracked for this family
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A .NET loader used in the middle stage of the kill chain. It extracts and injects the final njRAT payload into RegAsm.exe using process hollowing APIs such as ZwUnmapViewOfSection, VirtualAllocEx, and WriteProcessMemory.
A .NET loader reflectively loaded from a Cloudinary-hosted steganographic JPEG. It downloads the next stage from 91.92.242.219, drops it to C:\Users\Public\Downloads\, executes it via CasPol.exe, creates a scheduled task, sets a Registry Run key, and includes VM detection to evade sandbox analysis.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.