Trojan:Win32/Fareit.VB!MTB

user@threatcheck.sh ~ threat-analysis

bash

$ analyze-threat Trojan:Win32/Fareit.VB!MTB

Trojan:Win32/Fareit.VB!MTB - Windows Defender threat signature analysis

$ cat analysis.txt

=== THREAT ANALYSIS REPORT ===

Threat Name: Trojan:Win32/Fareit.VB!MTB

Classification:

Type:Trojan

Platform:Win32

Family:Fareit

Detection Type:Concrete

Known malware family with identified signatures

Variant:VB

Specific signature variant within the malware family

Suffix:!MTB

Detected via machine learning and behavioral analysis

Detection Method:Behavioral

Confidence:Very High

False-Positive Risk:Low

Concrete signature match: Trojan - Appears legitimate but performs malicious actions for 32-bit Windows platform, family Fareit

Summary:

Trojan:Win32/Fareit.VB!MTB is a concrete detection for a Fareit variant, an information-stealing trojan primarily written in Visual Basic. It leverages behavioral analysis to detect malicious activities such as clipboard theft, file manipulation (e.g., renaming), and potentially disguised execution to compromise system data and user credentials.

Severity:

Critical

VDM Static Detection:

Relevant strings associated with this threat:
 - MSVBVM60.DLL (PEHSTR)
 - MSVBVM60.DLL (PEHSTR_EXT)
 - Kawaii-Unicorn.exe (PEHSTR_EXT)
 - cmd /c rename (PEHSTR_EXT)
 - DllFunctionCall (PEHSTR_EXT)
 - \Unicorn (PEHSTR_EXT)
 - VB.Clipboard (PEHSTR_EXT)

YARA Rule:

rule Trojan_Win32_Fareit_VB_2147750074_0
{
    meta:
        author = "threatcheck.sh"
        detection_name = "Trojan:Win32/Fareit.VB!MTB"
        threat_id = "2147750074"
        type = "Trojan"
        platform = "Win32: Windows 32-bit platform"
        family = "Fareit"
        severity = "Critical"
        info = "MTB: Microsoft Threat Behavior"
        signature_type = "SIGNATURE_TYPE_PEHSTR"
        threshold = "2"
        strings_accuracy = "High"
    strings:
        $x_1_1 = "MSVBVM60.DLL" ascii //weight: 1
        $x_1_2 = "PULx9J99eP0jRV3p7OJHxVrvug7DNmV21" wide //weight: 1
    condition:
        (filesize < 20MB) and
        (all of ($x*))
}

Known malware which is associated with this threat:

Filename: virussign.com_bdd8429fc9e410edabc4f9a98daf8f60

361fa581739833c5be6cbaba616610a65e86dc929f2ec853d065dced343604dd

22/03/2026

→VirusTotal ↓Download Sample

Filename: virussign.com_ccef3ef89643236fdbce9213e4848f40

ff99e74817543693152b8a7090aa7d23ac57f67df6c613d149c501ea03382fb9

22/03/2026

→VirusTotal ↓Download Sample

Filename: virussign.com_ec851635ce58008da86f9a497f53ce50

28e6aa7c692ec47e56f15e1e356f206c2c02541d51c34c3bc219d4732fa9162a

22/03/2026

→VirusTotal ↓Download Sample

Filename: virussign.com_f53cf565baf090c80f708f0b2433ea40

6b28c43c1812482c46e8b7981a530051cf71f0e6baa623e61665bf43ef9bc2dd

22/03/2026

→VirusTotal ↓Download Sample

Filename: virussign.com_0600f81ada2d96f531f084b2c0ba0fd0

a15da37e544d66e0e5fd1e1622b7018f2ce224a9238994653b7f6ab20a9420c6

22/03/2026

→VirusTotal ↓Download Sample

Remediation Steps:

Isolate the infected endpoint immediately. Perform a full system scan with up-to-date antivirus software and remove all detected malicious files. Due to its nature as an info-stealer, reset all potentially compromised credentials (e.g., banking, email, social media, cryptocurrency wallets) that may have been accessed or copied while the malware was active. Implement strong email and web filtering to prevent future infections.

=== END REPORT ===

$ reanalyze-threat

This analysis was last updated on 22/03/2026. Do you want to analyze it again?

$ ls available-commands/

→ cd /home

user@threatcheck.sh:~$ ▊

Trojan:Win32/Fareit.VB!MTB - Windows Defender Threat Analysis