arrow_back
search
close

TSPY_FAREIT

August 20, 2013
 PLATFORM:

Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)

 OVERALL RISK RATING:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 SYSTEM IMPACT RATING:
 INFORMATION EXPOSURE:

  • Threat Type: Spyware

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

Infection Channel:

Downloaded from the Internet

FAREIT is a malware family of information stealers used to download other malware such as ZeuS/ZBOT onto infected systems. Its variants typically steal user names and passwords on stored in web browsers. In addition, these steal email credentials and FTP credentials such as the following:

  • Directory list

  • Password

  • Port Number

  • Server Name

  • Server Type

  • User Name

Users can get this malware by visiting malicious sites that host FAREIT variants.

  TECHNICAL DETAILS

Memory Resident:

Yes

Payload:

Connects to URLs/IPs

Other System Modifications

This spyware adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\WinRAR
HWID = "{GUID}"

Other Details

This spyware connects to the following possibly malicious URL:

  • http://10.{BLOCKED}a-call.com/forum/viewtopic.php
  • http://11.{BLOCKED}spc.com/forum/viewtopic.php
  • http://11.{BLOCKED}couponscode.com/forum/viewtopic.php
  • http://11.{BLOCKED}dsymptomsproblem.com/forum/viewtopic.php
  • http://4.{BLOCKED}o.com/forum/viewtopic.php
  • http://4.{BLOCKED}y.net/forum/viewtopic.php
  • http://4.{BLOCKED}candroid.com/forum/viewtopic.php
  • http://4.{BLOCKED}ctab.com/forum/viewtopic.php
  • http://6.{BLOCKED}icedams.com/forum/viewtopic.php
  • http://6.{BLOCKED}icedams.net/forum/viewtopic.php
  • http://o.{BLOCKED}terkings.com/forum/viewtopic.php
  • http://o.{BLOCKED}terkings.net/forum/viewtopic.php
  • http://one.{BLOCKED}rsar.org/forum/viewtopic.php
  • http://one.{BLOCKED}okeking.net/forum/viewtopic.php
  • http://{BLOCKED}.{BLOCKED}.13.164/b6dK7rwV.exe
  • http://{BLOCKED}3.a.hostable.me/Z2U.exe
  • http://{BLOCKED}.{BLOCKED}.21.252/PNV3Hbi.exe
  • http://{BLOCKED}rsystems.cc/EcYdbYWf.exe
  • http://WWW.{BLOCKED}ormatica.com/KCCm.exe
  • http://{BLOCKED}up.in/61AEjj.exe
  • http://{BLOCKED}nfarm.com/Y0t4P.exe
  • http://{BLOCKED}er-school.net/xFMTvTNP.exe
  • http://{BLOCKED}agicshow.com/CajTX4D.exe
  • http://{BLOCKED}rsi.com/2PveFFs.exe
  • http://{BLOCKED}rk.com/cAB.exe
  • http://{BLOCKED}s.com.vn/BN42.exe
  • http://{BLOCKED}rmet.com.ar/jGa9.exe
  • http://{BLOCKED}books.com/cBUkN9.exe
  • http://www.{BLOCKED}en24.de/WWkULwkq.exe
  • http://www.{BLOCKED}yaoriente.com.co/pbe.exe
  • http://www.{BLOCKED}ko.com/W14C.exe
  • http://www.{BLOCKED}r-art.at/fPsx8i.exe
  • http://{BLOCKED}nturesphotogifts.com/MzZGBi0o.exe

Related Malware