http://{BLOCKED}orld.com/1.exe

TSPY_FAREIT.ACU connects to this website to download and execute a malicious file. This malware disguises itself as an Opera update. Cybercriminals behind this threat stole an outdated Opera digital certificate, which they used to sign this malware.