On November 5, 2015, NSFOCUS Threat Analysis Center (TAC) intercepted an unknown virus targeting a bank and then named it Fareit trojan after sample analysis. Attackers could exploit Fareit trojan to compromise the target host by sending spam to trick users into clicking an .exe file, thereby stealing website information and passwords stored on the FTP client.

This document dwells upon the execution process and behaviors of Fareit trojan and provides an end-to-end solution from detection to network protection and terminal protection. The detailed analysis can act as an operational manual for trojan analysis and provides some patterns to facilitate analysis and protection against trojans intended for information stealing.

1 On November 5, NSFOCUS TAC intercepted unknown virus samples and provided protection.
2 On November 6, 55 detection tools were used by VirtusTotal, 12 of which detected the samples to be virus.
3 On November 7, Beijing R&D center, NSFOCUS, presented the sample analysis report.
4 On November 13, NSFOCUS released an in-depth analysis and protection solution.

NSFOCUS Threat Response Center (TRC) is keeping a close eye on the progress of the Fareit trojan attack event. For more information, please contact

• NSFOCUS by Sina Weibo at:
• http://blog.nsfocus.net/
• NSFOCUS Threat Response Center by Sina Weibo at:
• http://weibo.com/threatresponse
• NSFOCUS by finding:
• NSFOCUS at WeChat

Fareit Trojan

The sample virus is named Fareit trojan by a majority of vendors. It could be exploited to compromise the target host by sending spam to trick users into clicking an .exe file, thereby stealing website information and passwords stored on the FTP client. Fareit trojan targets information distribution centers, like FTP websites, and sends data to domain names such as http://tekboss.xyz, expecting more mission-critical information.

Recently NSFOCUS has detected multiple traffic packets destined for a malicious IP address, which are similar to this trojan. By using Kingsoft Security Terminal Platform, we discovered that the intercepted virus targeting a bank is a variant of the Fareit information stealer. By the time this report is released, 3071 virus samples have been detected globally, 944 of which is proved to Fareit variants. Fareit trojan is distributed globally, with 59.5% in the U.S and 31% in China.

According to data analysis, Fareit virus has been used to steal information since 2012. At the very beginning, it was only used to download malware, but gradually it has evolved into a tool for stealing data. In May 2013, India’s government affairs website was attacked. In this attack event, Fareit played a role for downloading trojan and stealing information. With the gradual evolution and global expansion of new versions, some variants of Fareit virus have integrated the C&C function, forming a large botnet. The data suggests that one Fareit variant can attack Bitcoin computers to steal Bitcoins and hide in the user’s machine, making it a zombie for hackers. According to the statistics in April 2015, zombies infected with Fareit trojan formed a botnet, which can send 7.7 billion spam every day and spread malware through email messages to steal online bank information and Bitcoin account information.

Sample Information

Potential Impacts of Fareit Trojan

• With a great number of variants, Fareit virus often targets valuable information distribution centers or financial product distribution centers.
• The sample was intercepted from a bank, which indicates that financial institutions are becoming the attack targets of Fareit trojan.
• Hidden and spoofing behaviors and code injection behaviors exist in the sample. Fareit trojan has as many as more than 900 variants and has a trend of evolving into a botnet.

Global Trend of Fareit Trojan Infection

Trojan Analysis

Behavior Analysis

On November 6, the second day after the virus sample was intercepted, antivirus software began to upgrade their virus library and signatures. According to the detection result of VirusTotal shown in Figure 1, 55 detection tools were used, 12 of which determined that the sample was a virus. Behavior analysis involves a lot of details and is briefed as follows:

Figure 2 shows the result of monitoring the process of executing the sample.

Malicious Behaviors

According to the behavior analysis, the sample could be exploited to compromise the target host by sending spam to trick users into clicking an .exe file, thereby stealing website information and passwords stored on the FTP client.

• This virus sample is mainly used for stealing FTP website information and user passwords from the target host.

Attackers could exploit this virus sample to determine whether FTP client software (such as GHISLER, CuteFTP, FlashFXP, FileZilla, or ExpanDrive) is installed on the target host by detecting whether certain files exist. If FTP software is installed, attackers will access the file for saving website information and passwords, read the file memory, search for the websites and passwords, and then upload the website information and passwords to their own server.

• This virus can hide itself.

If FTP software is not installed on the target host, the virus sample will create a BAT file under C:\Documents and Settings\Administrator\Local Settings\Temp. This BAT file is used to delete the sample file and BAT file, thereby hiding the virus. The virus sample creates two child processes to perpetrate malicious activities and cheat users by setting the user names of these two child processes to explorer.exe.

• Code injection behaviors exist.

The sample creates two child processes of its own name, injects a part of its code and ShellCode into these two child processes, and then starts the child processes, making the child processes execute different behaviors from their parent processes. The behaviors of the two child processes are identical.

• Malicious network behaviors exist in the sample execution process.

The virus sample steals the website information and passwords saved on the FTP client and uploads such information to the attacker’s server whose domain name is tekboss.xyz and IP address is 198.105.221.5.

Figure 4 shows the overall sample execution process.

Execution Process

The following dwells upon the execution process, so that security industry insiders can work out appropriate protection solutions based on the trojan execution characteristics.

File Operations

The virus sample determines whether the FTP software is installed by reading certain files under the installation directory of the FTP client software, such as GHISLER, CuteFTP, FlashFXP, FileZilla, or ExpanDrive.

Take CuteFTP as an example. If the FTP software is installed on the target host, the virus sample will read the sm.dat file, which saves the FTP website information and user passwords. If this file exists, the virus sample will then upload the information to its own server, 198.105.221.5.

The following shows paths to intercept files with the read access by adding breakpoints to the Kernel32.CreateFileW function:

If the sm.dat file exists, the virus sample reads the content and saves it to the memory. Then it searches for website information and user passwords in the sm.dat file. The following shows the key code for reading the file content and saves it to the memory.

The BAT file is used to delete itself and the sample file.

The following shows the code for calling the BAT file (the ShellExecuteA function is called for processing sample files in batches):

Network Operations
The following shows the key code for sending packets.

Packet information:

Process Operations

The Fareit sample uses CreateToolhelp32Snapshot, Process32First, and Process32Next functions to locate the explorer.exe process, uses OpenProcessToken to obtain the process token, uses ImpersonateLoggedOnUser to have the current process imitate the explorer.exe process, and then uses “administrator” as the login name of the current process.

The Fareit sample is a VB program. In the execution process, it creates two processes and injects the code of the current process and ShellCode into the target process, making the new processes execute specific code. The following shows the ShellCode code:

The following shows the process in which the Fareit sample creates new processes and injects code into the new processes.

Registry Operations

The main function of registry operations is as follows:

The Fareit sample traverses the registry entries under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ to view the software installed on the target host system. 【The Fareit sample checks whether FTP software is installed.】

The following are several registry entries intercepted:

The following shows partial code for registry operations:

Detection and Prevention

Malware is often sent to the target host as an email attachment. Therefore, users should be cautious when opening emails from unknown sources. As a proprietary product of NSFOCUS, NSFOCUS TAC can effectively detect unknown attacks, preventing unpredictable loss caused by malware for users.

Virtual Execution Detection Technique of NSFOCUS TAC

On November 5, after NSFOCUS TAC intercepted the Fareit trojan sample, it was found that only 6 of 55 pieces of antivirus software could analyze it for virus. Since this was unknown malware, it was not uniformly named. The core virtual execution technique contributes to TAC’s quick detection of unknown threats.

• Detection principles:

   NSFOCUS TAC executes the entire or partial sample in the virtual environment and records the execution behaviors, based on which NSFOCUS TAC determines whether the sample is malicious.
   Traditional signature-based devices detect malware by matching patterns. That is, they extract certain binary character sequences to identify the sample. This matching mode can only detect known malicious samples and can be easily bypassed by software protection tools. It is totally helpless in the face of new malicious samples, and therefore the signature base needs to be continuously updated to cope with emerging malicious samples.
   Virtual execution is based on the detection of attack behaviors, whose types change very slowly. No matter how new samples change or are protected, they will finally perform malicious behaviors (such as executing shellcode or launching C&C attacks) after execution. Generally, these behaviors cannot be hidden.

• Types of virtual execution

  According to the virtual environment, virtual execution falls into lightweight virtual execution and system-level virtual execution.
  Lightweight virtual execution is to execute the code fragments and determine whether the sample is malicious according to the logical behaviors of the code sequence.
  System-level virtual execution simulates the real environment to the greatest extent, including the entire operating system and application environment, and then judges the execution behaviors of the virus sample.

  • Currently, system-level virtual execution is subdivided into API monitoring-based virtual execution and dynamic translation-based virtual execution. The API monitoring-based virtual execution can only detect API behaviors and is often used by traditional sandboxes. • Dynamic translation-based virtual execution can detect the code and identify more malicious behaviors and virtual execution evasion behaviors. Currently, NSFOCUS TAC adopts this technique.

• Virtual execution evasion technique

 Currently, evasion techniques against virtual execution emerge. These evasion techniques can be used to bypass the detection of certain virtual execution engines.
 However, NSFOCUS has the detection technique to detect the malicious samples which can bypass virtual execution.

NGTP Network Protection Technique

Based on the advanced virtual execution technique, NSFOCUS Next-Generation Threat Protection Solution (NGTP) can effectively detect and prevent Fareit trojan attacks. NSFOCUS NGTP consists of NSFOCUS TAC (the local sandbox), NSFOCUS Network Intrusion Prevention System (NIPS), NSFOCUS security reputation, and NSFOCUS Enterprise Security Planning Customer (ESPC). The procedure for NGTP to prevent trojan and even 0-day vulnerabilities is as follows:

• Step 1 Use TAC to detect viruses: TAC performs static analysis of shellcode with its static check engine and then virtual execution with its Shellcode static analysis. In this way, Fareit trojan is detected.
• Step 2 After TAC detecting the source of the malware, TAC generates the reputation information, including the file reputation and source IP address of the attack. The reputation information will be synchronized to the local ESPC, forming a local reputation library.
• Step 3 After receiving the reputation information of the malware from the local reputation library, NIPS blocks the source IP address and generates an alert log.

Kingsoft’s Suggestions for Terminal Protection

Fareit trojan is mainly exploited to send spam to steal online bank information and Bitcoin account information. As suggested by Kingsoft security experts, to prevent such trojan virus, do not open email attachments from strangers, update system patches and browsers timely, and use Kingsoft AntiVirus (for individuals) or V8+ (for enterprises) to protect the computer system and individual information.

Overall Solution of NGTP

NGTP can cope with trojans and even 0-day vulnerability attacks with ease. Focusing on the APT attack chain, it can effectively detect and prevent APT attacks in three major stages, that is, reconnaissance, lure, and data theft.

Characterized by globally distributed threat detection clouds and focusing on detection of unknown threats, NGTP collaborates with traditional terminal and gateway devices for the sharing of threat intelligence across vendors and visualization of threat trends to achieve the aim of improving enterprises’ capability of preventing APTs.

Threat Intelligence

The obtaining of and responding to threat-related intelligence, to some extent, reflect a security vendor’s protection capacity. The threat intelligence service system consists of at least threat monitoring and responding, data analysis and sorting, business intelligence and delivery, risk assessment and consultancy, and security hosting and application, involving the research, products, services, operations, and marketing. NSFOCUS, through an all-round emergency response system covering the research, cloud, products, and services, promptly provides threat intelligence and follow-up services regarding Anonymous attacks for enterprises and organizations, ensuring their business continuity.
For any questions or more information, please contact us by searching Sina Weibo or WeChat for NSFOCUS.

About NSFOCUS

NSFOCUS Information Technology Co., Ltd. (NSFOCUS) was founded in April 2000, headquartered in Beijing. With more than 30 branches and subsidiaries at home and abroad, the company provides most competitive security products and solutions for governments, carriers, and financial, energy, Internet, education, and medical sectors, ensuring customers’ business continuity.
Based on years of research in security assurance, NSFOCUS has set foot in network and terminal security, Internet infrastructure security, and compliance and security management. The company provides the intrusion detection/prevention system, anti-DDoS system, remote security assessment system, and web security protection products as well as professional security services for customers.
NSFOCUS Information Technology Co., Ltd. started trading its shares at China’s Nasdaq-style market, ChiNext, in Shenzhen on January 29, 2014, with the name of NSFOCUS and code of 300369.