{
  "family": "hpfareit",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nHPFareit is an alias used by specific security vendors to identify variants of the highly prolific **Fareit** (also known as Pony) malware family. It is a sophisticated information stealer and downloader designed to harvest a vast array of credentials, session tokens, and cryptocurrency wallets from compromised endpoints, before frequently downloading secondary payloads.\n\n<h3>Infection Vector and Extraction Methodology</h3>\nHPFareit is primarily distributed via massive malspam campaigns, often disguised as invoices or shipping documents containing malicious macro-enabled attachments or links to exploit kits.\n\nUpon execution, HPFareit performs rapid, automated data extraction:\n<ul>\n<li><strong>Credential Theft:</strong> It systematically targets over 100 different applications, extracting stored passwords from web browsers (Chrome, Firefox, Edge), FTP clients (FileZilla, WinSCP), email clients (Outlook, Thunderbird), and instant messaging programs.</li>\n<li><strong>Cryptocurrency Targeting:</strong> It actively searches for and steals wallet files (e.g., `wallet.dat`) associated with popular cryptocurrencies like Bitcoin, Litecoin, and Ethereum.</li>\n<li><strong>Data Exfiltration:</strong> The stolen data is aggregated, compressed, and covertly transmitted to a remote command-and-control (C2) server via HTTP POST requests or FTP uploads.</li>\n</ul>\nAfter the initial data theft is complete, HPFareit frequently acts as a downloader, reaching out to its C2 server to fetch and execute secondary malware, such as the ZeuS banking trojan or various ransomware families.\n\n<h3>Security and Privacy Implications</h3>\nAn HPFareit infection is a critical security breach resulting in the immediate compromise of corporate and personal credentials. This stolen intelligence is often sold on dark web marketplaces or used immediately to pivot laterally within the corporate network.\n\n<h3>Incident Response and Mitigation</h3>\n<ul>\n<li><strong>Credential Invalidation:</strong> Immediate, organization-wide password resets are mandatory following a confirmed HPFareit infection. All active session tokens must be forcibly revoked.</li>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Deploy EDR solutions configured to alert on processes attempting unauthorized, bulk access to browser profile directories (`%LocalAppData%\\Google\\Chrome\\User Data`) and the `CryptUnprotectData` API.</li>\n<li><strong>Email Security:</strong> Implement strict email filtering and sandboxing to block malicious attachments (macros, scripts) before they reach the end-user.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.Fareit",
    "Pony Stealer",
    "PasswordStealer.Fareit",
    "Win32/Fareit"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1555.003",
    "T1003",
    "T1048.003",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T16:13:06Z",
  "type": "InfoStealer",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}