Support Site User Guide

Category:     Viruses and Spyware

Type:           Trojan

Aliases:       Pony Botnet

Affected Operating Systems: Windows

 

Summary

Win32/Fareit is a multiple component malware family that consists of a password stealing component, PWS:Win32/Fareit, that steals sensitive information from the affected user's computer and sends it to a remote attacker, and a Distributed Denial of Service (DDoS) component, DDoS:Win32/Fareit.gen!A, that may be commanded to perform flooding attacks against other servers.

 

Symptoms

System changes

The following system changes may indicate the presence of this malware:

The presence of the following files:

%ProgramFiles%/lp/<four hexadecimal digits>/<number>.tmp

%AppData%\dwme.exe

%TEMP%\dwme.exe

%AppData%\svhostu.exe

%TEMP%\svhostu.exe

%AppData%\pny\pnd.exe

The presence of the following registry modifications:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Sets value: "Microsoft PnD"

With data: %AppData%\pny\pnd.exe

In subkey: HKCU\Software\WinRAR

Sets value: "HWID"

With data: <unique identifier> (for example, {D9CD7060-83A2-46D0-8CEA-5EDF6043EEC7})

 

Technical Information (Analysis)

Win32/Fareit is a multiple component malware family that consists of a password stealing component, PWS:Win32/Fareit, that steals sensitive information from the affected user's computer and sends it to a remote attacker, and a Distributed Denial of Service (DDoS) component, DDoS:Win32/Fareit.gen!A, that may be commanded to perform flooding attacks against other servers.

 

Installation

Win32/Fareit may be installed by other malware.

PWS:Win32/Fareit  is usually installed to a particular location by other malware, then run from this location.

For example, Backdoor:Win32/Cycbot installs it to %ProgramFiles%/lp/<four hexadecimal digits>/<number>.tmp (such as  %ProgramFiles%\lp\008a\7.tmp), while Rogue:Win32/FakeScanti installs it to %AppData%\dwme.exe and %temp%\dwme.exe, or %AppData%\svhostu.exe and %temp%\svhostu.exe.

DDoS:Win32/Fareit.gen!A terminates any previous versions of itself that may be running, and copies itself to %AppData%\pny\pnd.exe.

 

It creates the following registry entry to ensure that this copy executes at each Windows start:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Sets value: "Microsoft PnD"

With data: %AppData%\pny\pnd.exe

It then runs the new copy.

 

Both components create a registry entry such as the following:

In subkey: HKCU\Software\WinRAR

Sets value: "HWID"

With data: <unique identifier> (for example, {D9CD7060-83A2-46D0-8CEA-5EDF6043EEC7})

Some variants of PWS:Win32/Fareit delete themselves once they have finished running.

 

Payload

Steals sensitive information.

PWS:Win32/Fareit  attempts to retrieve stored website passwords from various browsers including Chrome, Firefox, Internet Explorer, and Opera.

It also attempts to steal stored account information, such as server names, port numbers, login IDs and passwords from the following FTP clients or cloud storage programs if these are installed:

 

It then posts all of this information to a remote server. Examples of servers contacted by the malware include:

 

DDoS:Win32/Fareit.gen!A  contacts a command and control server which may request that it participate in DDoS attacks against other servers of its choosing. It then floods the attacked server with multiple HTTP GET or POST requests. It changes the header of the various requests so that each appears to come from a unique referrer (the webpage that the request appears to be linked from), and from multiple web browser versions and languages. This makes these requests more difficult for the attacked server to filter out.

 

Examples of command and control servers used at the time of publication include the following:

176. <removed>.112.90

176. <removed>.112.95

178. <removed>.166.154

2220 <removed>966122.ru

drea <removed>milos4.ru

For more information, please see the description for DDoS:Win32/Fareit.gen!A elsewhere in the encyclopedia.

Downloads and executes arbitrary files

Some samples of PWS:Win32/Fareit have been observed downloading an additional file, saving it to the %TEMP% directory, and then executing it. At the time of publication, these files were variants of PWS:Win32/Zbot.

If a new version of DDoS:Win32/Fareit.gen!A is available, its command and control server may provide a copy of the updated file. This file is then saved to the %TEMP% directory then executed.

 

Removal

If you are using Sophos please follow the below link for removal instructions.

http://www.sophos.com/en-us/support/knowledgebase/112129.aspx

 

If the Sophos scan does not work please use the following guide.

(The guide linked below is not written by Wavenet Education or LGfL so it is used at your own risk)

http://www.cleanpcguide.com/remove-ddoswin32fareit-removal-guide-how-to-remove-ddoswin32fareit

Return to main page