A forum for reverse engineering, OS internals and malware analysis 

Win32/Fareit

Forum for analysis and discussion about malware.

Win32/Fareit

 #11007  by EX!
 Fri Jan 13, 2012 4:05 pm
https://www.virustotal.com/file/f856b07 ... 326469918/

Detection ratio: 17 / 43

Maybe Spyeye.

Downloaded from c&c
hxxp://fdgsafkgdsfaskfshfgjahsgdf634570.in/sallemoz.dyndns.org/gate.php
Attachments
pass = infected
(888.06 KiB) Downloaded 201 times
Last edited by EP_X0FF on Mon Mar 11, 2013 8:14 am, edited 2 times in total. Reason: c&c link disabled

Re: Trojan SpyEye (alias Pincav)

 #11008  by EP_X0FF
 Fri Jan 13, 2012 4:19 pm
EX! wrote:https://www.virustotal.com/file/f856b07308b5113ee2c89ca4ac9a5808d597bb5381d917b2826b3e26b54fa372/analysis/1326469918/

Detection ratio: 17 / 43

Maybe Spyeye.

Downloaded from c&c
hxxp://fdgsafkgdsfaskfshfgjahsgdf634570.in/sallemoz.dyndns.org/gate.php
This is different password stealer written on Delphi and packed by UPX.
Stealing implemented in separate Delphi modules, for example (names should be enough self-explaining)

TModule_CuteFTP
TModule_FlashFXP
TModule_FileZilla
TModule_FTPCommander
TModule_BProofFTP
TModule_SmartFTP
TModule_TurboFTP
TModule_FFFTP
TModule_CoreFTP
TModule_Frigate3
TModule_SecureFX
TModule_UltraFXP_Base
TModule_UltraFXP
TModule_FTPRushX
TModule_WebSitePublisher
TModule_BitKinex
TModule_ExpanDrive
TModule_ClassicFTP
TModule_Fling
TModule_SoftX
TModule_DOpus
TModule_FTPUploader
TModule_FreeFTPd

and a lot of others.

Slightly longer description of this trojan can be found here

Config.zip and config.bin indeed SpyEye configs, but without SpyEye dropper it's hard to unpack them due to long password.

Re: PWS:Win32/Fareit.A

 #11692  by rkhunter
 Sat Feb 18, 2012 6:20 pm
Fareit was active at last few days, 10 droppers in archive.
Attachments
pass:infected
(1.06 MiB) Downloaded 154 times

Re: Trojan Zeus (alias ZBot)

 #12401  by thisisu
 Fri Mar 30, 2012 8:03 am
rkhunter wrote:
thisisu wrote:MD5: 71388404bb160b5a85d76185af96a4b0
Not ZBot, Fareit PWS.
Hi rkhunter,

I'm sorry about that :oops:
  • 1
  • 2
  • 3
  • 4
  • 5
  • 7
 Return to “Malware”