Analysis by: Rika Joi Gregorio
ALIASES:

PWS:Win32/Fareit.gen!I(Microsoft), Trojan.Win32.Tepfer.a (v)(Sunbelt), W32/Fareit.A!tr.pws(Fortinet), Trojan-PWS.Win32.Fareit(Ikarus), Win32/PSW.Fareit.A trojan(Eset)

 PLATFORM:

Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)

 OVERALL RISK RATING:
 REPORTED INFECTION:
 SYSTEM IMPACT RATING:
 INFORMATION EXPOSURE:

  • Threat Type: Spyware

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

  TECHNICAL DETAILS

File Size: 133,120 bytes
File Type: EXE
Memory Resident: Yes
Initial Samples Received Date: 26 Feb 2013

Arrival Details

This spyware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other System Modifications

This spyware adds the following registry entries:

HKEY_CURRENT_USER\Software\WinRAR
HWID = "{random value}"

Download Routine

This spyware connects to the following website(s) to download and execute a malicious file:

  • http://www.{BLOCKED}o.de/G3ii5p1o.exe
  • http://{BLOCKED}.{BLOCKED}.207.68/ZN .exe
  • http://www.{BLOCKED}zin.com/H6mXpy.exe
  • http://www.{BLOCKED}x.com.tr/g3Asmrw.exe
  • http://{BLOCKED}i.co.za 6dne5e.exe
  • http://{BLOCKED}n.gr/mw3rhpQ2.exe

Other Details

This spyware connects to the following possibly malicious URL:

  • http://{BLOCKED}x.net:8080/forum/viewtopic.php
  • http://{BLOCKED}andfriendfinder.net:8080/forum/viewtopic.php
  • http://{BLOCKED}.{BLOCKED}.158.195:8080/forum/viewtopic.php
  • http://{BLOCKED}oguide.com:8080/forum/viewtopic.php