Loading malware…
Fuery is a Windows implant written in Go 1.20.1 and obfuscated with Garble. It was observed as a payload delivered by the Amadey botnet in campaign fbf543, including a sample masquerading as volunteers.exe. Analysis describes Fuery as using a novel structural obfuscation scheme that embeds Raft consensus protocol data structures such as AppendEntries, VoteRequest, VoteResponse, LogEntry, LogIndex, NodeID, and Term, along with VP8/VP9-related structures, to disguise its custom little-endian binary command-and-control protocol and hinder static analysis. Researchers linked this obfuscation framework to a related SmokeLoader variant compiled with the same Go 1.20.1 toolchain.
Fuery communicates using raw WinSock APIs rather than high-level HTTP/TLS libraries in one analyzed sample set, and supports broad implant functionality including process injection via thread context hijacking, host reconnaissance, file-system operations, anti-analysis checks, and access to the Windows certificate store. Reported anti-analysis features include Wine detection, timer and sleep-manipulation checks, a custom exception handler, SetErrorMode, SetConsoleCtrlHandler, a zeroed PE timestamp, and stripped build paths.
Separate infrastructure analysis identified Fuery command-and-control at laf.oahgsfwklg.top (178.16.54.79), with a server stack of nginx and PHP 7.4.33 using Laravel cookies and a panel named "Monkey." In that observed infrastructure, Fuery used POST requests to single-letter endpoints /t, /s, /c, /f, and /v, which returned base64-encoded encrypted blobs or empty responses. The malware downloaded libeay32.dll and ssleay32.dll corresponding to OpenSSL 1.0.1g, which enabled SMTP exfiltration via smtp.gmail.com over TCP port 465; sandbox traffic was observed to 209.85.202.108:465. One report states the binary contained 13 hardcoded domains, but only laf.oahgsfwklg.top resolved at the time, while the others returned NXDOMAIN.
Fuery has been associated with the operator alias "ingermany" in reporting that linked Fuery and SmokeLoader infrastructure through certificates, hosting history, and WHOIS/SOA artifacts, though attribution confidence is limited. It appeared among multiple malware families distributed in the Amadey fbf543 pay-per-install campaign, indicating use in financially motivated cybercrime operations rather than a single-purpose intrusion set.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Fuery is a garble-obfuscated Go 1.20.1 implant dropped by the Amadey botnet (campaign fbf543) that uses Raft consensus protocol data structures as a novel obfuscation layer to disguise its custom binary C2 protocol.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
MITRE ATT&CK Mapping ... Initial Access Phishing / Loader delivery T1566 Dropped by Amadey botnet
MITRE ATT&CK Mapping ... Execution Native API T1106 LoadLibrary / GetProcAddress for all DLL resolution
MITRE ATT&CK Mapping ... Persistence Registry Run Keys T1547 RegOpenKeyExW / RegQueryValueExW capability
Process Injection via Thread Hijacking CreateToolhelp32Snapshot -> Process32FirstW/NextW -> OpenProcess -> SuspendThread -> GetThreadContext -> SetThreadContext -> ResumeThread This is the classic thread context hijacking chain (T1055.003).
MITRE ATT&CK Mapping ... Privilege Escalation Access Token Manipulation T1134 GetTokenInformation
MITRE ATT&CK Mapping ... Persistence Registry Run Keys T1547 RegOpenKeyExW / RegQueryValueExW capability
Novel Obfuscation: Raft Consensus Protocol Type Abuse ... The Go binaries use Raft consensus protocol type names as disguises for malware data structures ... to make the binary appear to be a legitimate distributed systems application during static analysis.
MITRE ATT&CK Mapping ... Defense Evasion Software Packing T1027.002 Custom identifier obfuscation framework
The PE version info populates every field with "volunteers", creating a thin disguise as a benign application. ... MITRE ATT&CK Mapping ... Match Legitimate Name T1036.005 volunteers.exe masquerade
Process Injection via Thread Hijacking CreateToolhelp32Snapshot -> Process32FirstW/NextW -> OpenProcess -> SuspendThread -> GetThreadContext -> SetThreadContext -> ResumeThread This is the classic thread context hijacking chain (T1055.003).
The compile timestamp is zeroed -- a deliberate anti-forensics measure. ... MITRE ATT&CK Mapping ... Defense Evasion Timestomp T1070.006 Zeroed PE compile timestamp
MITRE ATT&CK Mapping ... Privilege Escalation Access Token Manipulation T1134 GetTokenInformation
MITRE ATT&CK Mapping ... Defense Evasion Deobfuscate/Decode Files T1140 Runtime config construction
MITRE ATT&CK Mapping ... Discovery Query Registry T1012 RegOpenKeyExW, RegEnumKeyExW
MITRE ATT&CK Mapping ... Discovery System Network Configuration T1016 GetAdaptersInfo, GetIfEntry
MITRE ATT&CK Mapping ... Discovery System Owner/User Discovery T1033 GetUserNameExW
MITRE ATT&CK Mapping ... Discovery Process Discovery T1057 CreateToolhelp32Snapshot / Process32FirstW
MITRE ATT&CK Mapping ... Discovery System Information Discovery T1082 GetSystemInfo, RtlGetNtVersionNumbers
MITRE ATT&CK Mapping ... Discovery File and Directory Discovery T1083 FindFirstFileW / FindNextFileW
MITRE ATT&CK Mapping ... Collection Data from Local System T1005 ReadFile, CreateFileMappingW
MITRE ATT&CK Mapping ... Command and Control Data Obfuscation T1001 Raft protocol framing
MITRE ATT&CK Mapping ... Command and Control Application Layer Protocol T1071 Custom binary protocol over raw TCP
These DLLs enable the bot to exfiltrate data via smtp.gmail.com:465
The Fuery bot downloads OpenSSL DLLs from its C2 for SMTP-based exfiltration: /fd/libeay32.dll ... /fd/ssleay32.dll
MITRE ATT&CK Mapping ... Command and Control Encrypted Channel T1573 Custom encryption (no stdlib crypto)
MITRE ATT&CK Mapping ... Exfiltration Exfiltration Over C2 Channel T1041 TransmitFile, WSASend
These DLLs enable the bot to exfiltrate data via smtp.gmail.com:465 (observed in sandbox: TCP to 209.85.202.108:465).
MITRE ATT&CK Mapping ... Impact Service Stop T1489 TerminateProcess
31 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.