Fspm

Category: ransomware · Aliases: HackTool.Fspm, Exploit.Win32.Fspm, Tool.NetworkScanner · Sample count (EMBER 2018): 1 · Enrichment: insufficient_information · Updated: 2026-07-02T07:36:34Z

Category: RansomwareActor: Unknown / CybercriminalIndustry: Global / OpportunisticMotivation: Opportunistic

Overview

Executive Summary

Fspm is a classification typically applied to a HackTool or localized exploit script designed to bypass security controls or facilitate unauthorized access, often specifically targeting misconfigurations or vulnerabilities in file sharing protocols or specific enterprise software suites. The presence of an Fspm tool indicates a targeted attempt by an attacker (or an unauthorized insider) to map, exploit, or extract data from network resources.

Infection Vector and Technical Capabilities

Fspm tools are generally not self-spreading malware. They are explicitly downloaded and executed by an attacker who has already gained initial access to a network (e.g., via a compromised VPN or RDP session) and is attempting to move laterally or locate sensitive data. Capabilities vary based on the specific variant, but generally focus on network exploitation:

Protocol Scanning and Exploitation: The tool may rapidly scan the local subnet for specific open ports (like SMB/445 or FTP/21) and attempt to exploit known vulnerabilities or misconfigurations (such as anonymous access or weak default credentials).
Share Enumeration: Fspm tools often automate the process of mapping hidden or administrative network shares (e.g., `C$`, `ADMIN$`), allowing the attacker to locate file servers, backup repositories, or user directories that should be restricted.
Brute-Forcing: Some variants include localized brute-forcing capabilities, attempting a rapid dictionary attack against identified services using a hardcoded list of common corporate passwords.

Threat Assessment

The detection of an Fspm tool is a critical security event indicating active, post-compromise lateral movement and reconnaissance. The attacker is actively mapping the internal network topology and attempting to identify targets for data exfiltration or ransomware deployment.

Incident Response and Remediation

Immediate Endpoint Isolation: The endpoint where the Fspm tool was executed must be isolated from the network immediately to halt the active reconnaissance and prevent further lateral movement.
Hunt for Lateral Movement (Network Logs): Security analysts must review internal firewall logs, Windows Event Logs (specifically Event ID 4624 - Successful Logon), and EDR telemetry to trace the network connections initiated by the tool. Identify any internal servers or shares the attacker successfully accessed.
Re-imaging and Credential Audit: The compromised machine must be wiped and re-imaged from a known-good baseline. A comprehensive audit of network share permissions and service account credentials is required to remediate the vulnerabilities the tool was attempting to exploit.

Known aliases

Threat reports may refer to this family under multiple names:

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1046 T1135 T1110.001

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_FSPM {
    meta:
        description = "Detects Fspm (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "fspm" ascii wide nocase
        $s2 = "hacktool.fspm" ascii wide nocase
        $s3 = "exploit.win32.fspm" ascii wide nocase
        $s4 = "tool.networkscanner" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Fspm Activity
id: 7de183178259f876e67c6ab67a811c70
status: experimental
description: Detects generic indicators of the fspm malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*fspm*"
            - "*hacktool.fspm*"
            - "*exploit.win32.fspm*"
            - "*tool.networkscanner*"
    condition: selection
level: medium

References & External Analysis

Search "fspm" on VirusTotal (External Analysis)

Frequently Asked Questions

How do I remove the Fspm Ransomware from Windows?

Manual removal of Fspm is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.

Is Fspm a virus or a Ransomware?

Fspm is classified as a Ransomware. Unlike traditional viruses that infect files, modern malware like Fspm typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.

What are the main symptoms of a Fspm infection?

Symptoms of Fspm can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.

Related Families (Category: ransomware)

Explore other malware families in the same category:

Protect Your Network Against Ransomwares

Want to prevent Fspm and similar threats from compromising your organization? Read our comprehensive defensive guide: Ransomware Protection Guide.

Need help with an active incident? Published by the SystemHelpdesk team.

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/fspm.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.