Home Malware Programs Trojans W32/Tepfer.D8A1

W32/Tepfer.D8A1

Posted: August 29, 2013

Threat Metric

Threat Level: 9/10
Infected PCs: 7
First Seen: August 29, 2013
Last Seen: October 18, 2020
OS(es) Affected: Windows

W32/Tepfer.D8A1 is a Trojan that spreads via a spear FTP phishing attack. W32/Tepfer.D8A1 is able to target numerous organizations. Such attacks are considered as a part of APTs (Advanced Persistent Threats), which aim to get a foothold in the network of an organization. W32/Tepfer.D8A1 is distributed via spam emails carrying malicious file attachments, detected as W32/Tepfer.D8A1. W32/Tepfer.D8A1 targets FTP clients. FTP clients are used in many corporations for secure file transferring, and the malware infection is basically targeting these to steal any sensitive information. W32/Tepfer.D8A1 steals user information from FTP software using certain Windows API functions. W32/Tepfer.D8A1 aims to download malicious files from the certain URLs. W32/Tepfer.D8A1 saves the downloaded executable files to the Temporary folder, then executes them. W32/Tepfer.D8A1 eliminates itself from the current folder. W32/Tepfer.D8A1 aims to steal stored account information or credentials of particular applications. The stolen information is then transmitted by W32/Tepfer.D8A1 to one of the certain URLs.W32/Tepfer.D8A1 arrives packaged with UPX and, once unpacked, it has its own mechanisms in place to block emulation. W32/Tepfer.D8A1 gathers details of an affected host's FTcP servers. W32/Tepfer.D8A1 watches for many popular FTP programs, which include Ghisler's Windows and Total Commander, FireZilla, GlobalSCAPE CuteFTP, Far FTP, WS_FTP and FlashFXP. For CuteFTP W32/Tepfer.D8A1 queries the Windows Registry. By searching for CuteFTP's .dat file (sm.dat - site manager data file), W32/Tepfer.D8A1 can conceal CuteFTP Pro, CuteFTP and CuteFTP Lite. W32/Tepfer.D8A1 also conceals CuteFTP's QCToolbar versions 6, 7 and 8 for both Home and Professional editions by querying the QCHistory registry entries. To acquire FTP details W32/Tepfer.D8A1 queries the Windows Registry for the path of either an .ini or .dat file. W32/Tepfer.D8A1 can also query for the actual host, username and password linked to the certain FTP client application via registry subkeys. Also, whenever possible W32/Tepfer.D8A1 also checks the ShSpecialFolder for the existence of known FTP client directories and then manually searches for both the .ini and .dat files. W32/Tepfer.D8A1 looks for specific directories using CSIDL values. W32/Tepfer.D8A1 may display a firewall alert that an executable is attempting to connect to the Internet. cotemplate:aliases]

Technical Details

Additional Information

The following URL's were detected:
http://[Removed]-law.com/f6gGoc.exehttp://[Removed]bowling.com/9zifqS.exehttp://[Removed]house.net/ponyb/gate.phphttp://[Removed]kiddoh.com/ponyb/gate.phphttp://[Removed]walla.com/ponyb/gate.phphttp://toft[Removed]school.co.uk/iF5DFSZ.exe
Loading...