24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 39:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.PWS.Tepfer Sample 0f0f59593cfa… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0f0f59593cfa…. Malware family: Trojan.PWS.Tepfer. Threat score 100/100. 16/27 AV engines flagged this file. 5 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0f0f59593cfae8f5fb3d1ab9af840348c2866a8bddf95be8f98cb7e8874b1138","keywords":["Malicious","Trojan.PWS.Tepfer","malware analysis","sandbox report","threat intelligence","0f0f59593cfae8f5fb3d1ab9af840348c2866a8bddf95be8f98cb7e8874b1138"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"0f0f59593cfae8f5fb3d1ab9af840348c2866a8bddf95be8f98cb7e8874b1138","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.PWS.Tepfer","antivirusDetections":{"malicious":16,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T65a,Found api reference "CryptGetUserKey" (Indicator: "CryptGetUserKey"; Source: "00000000-00007224.00000000.229229.00413000.00000004.mdmp") Found api reference "CryptExportKey" (Indicator: "CryptExportKey"; Source: "00000000-00007224.00000000.229229.00413000.00000004.mdmp, 00000000-00007224.00000000.229229.030D0000.00000004.mdmp, 00000000-00007224.00000001.231151.030D0000.00000004.mdmp") Found api reference "CryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00007224.00000000.229229.00413000.00000004.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00007224.00000000.229229.00413000.00000004.mdmp") Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "00000000-00007224.00000000.229229.00413000.00000004.mdmp") Found api reference "CertOpenSystemStoreA" (Indicator: "CertOpenSystemStoreA"; Source: "00000000-00007224.00000000.229229.00413000.00000004.mdmp") Found api reference "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; Source: "00000000-00007224.00000000.229229.00413000.00000004.mdmp") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00007224.00000000.229229.00413000.00000004.mdmp") Found api reference "CryptAcquireCertificatePrivateKey" (Indicator: "CryptAcquireCertificatePrivateKey"; Source: "00000000-00007224.00000000.229229.00413000.00000004.mdmp") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00007224.00000000.229229.030D0000.00000004.mdmp, 00000000-00007224.00000001.231151.030D0000.00000004.mdmp")26:T441,Found XOR loop in file "sample.bin" at offset 175907; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 178849; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 215084; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 226887; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 308522; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 50805; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 112172; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 172349; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 217508; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 245792; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6088; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 56474; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 122918; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 314345; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 380318; code bytes = 803027:Tc6f,"" (Indicator: "GetDC"; Source: "00000000-00007224.00000000.229229.030D0000.00000004.mdmp, 00000000-00007224.00000001.231151.030D0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007224.00000000.229229.030D0000.00000004.mdmp, 00000000-00007224.00000001.231151.030D0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007224.00000000.229229.030D0000.00000004.mdmp, 00000000-00007224.00000001.231151.030D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007224.00000000.229229.030D0000.00000004.mdmp, 00000000-00007224.00000001.231151.030D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007224.00000000.229229.030D0000.00000004.mdmp, 00000000-00007224.00000001.231151.030D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007224.00000000.229229.030D0000.00000004.mdmp, 00000000-00007224.00000001.231151.030D0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007224.00000000.229229.030D0000.00000004.mdmp, 00000000-00007224.00000001.231151.030D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007224.00000000.229229.030D0000.00000004.mdmp, 00000000-00007224.00000001.231151.030D0000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00007224.00000001.231151.07970000.00000040.mdmp")33:T762,Found string ""password" : "" (Indicator: "password"; File: "00000000-00007224.00000000.229229.00401000.00000020.mdmp"), Found string "password_value" (Indicator: "password"; File: "00000000-00007224.00000000.229229.00401000.00000020.mdmp"), Found string "password 51:b:" (Indicator: "password"; File: "00000000-00007224.00000000.229229.00401000.00000020.mdmp"), Found string "FTP destination password" (Indicator: "password"; File: "00000000-00007224.00000000.229229.00401000.00000020.mdmp"), Found string "inetcomm server passwords" (Indicator: "password"; File: "00000000-00007224.00000000.229229.00401000.00000020.mdmp"), Found string "outlook account manager passwords" (Indicator: "password"; File: "00000000-00007224.00000000.229229.00401000.00000020.mdmp"), Found string "password" (Indicator: "password"; Source: "00000000-00007224.00000000.229229.00413000.00000004.mdmp"), Found string "password1" (Indicator: "password"; Source: "00000000-00007224.00000000.229229.00413000.00000004.mdmp"), Found string "secret" (Indicator: "secret"; Source: "00000000-00007224.00000000.229229.00413000.00000004.mdmp"), Found string ""password" : "" (Indicator: "password"; Source: "00000000-00007224.00000000.229229.00413000.00000004.mdmp") Found string "password_value" (Indicator: "password"; Source: "00000000-00007224.00000000.229229.00413000.00000004.mdmp") Found string "password 51:b:" (Indicator: "password"; Source: "00000000-00007224.00000000.229229.00413000.00000004.mdmp") Found string "FTP destination password" (Indicator: "password"; Source: "00000000-00007224.00000000.229229.00413000.00000004.mdmp") Found string "inetcomm server passwords" (Indicator: "password"; Source: "00000000-00007224.00000000.229229.00413000.00000004.mdmp") Found string "outlook account manager passwords" (Indicator: "password"; Source: "00000000-00007224.00000000.229229.00413000.00000004.mdmp")34:T7b6,"Software\Ghisler\Windows Commander" (Indicator: "software\ghisler\windows commander") "Software\Ghisler\Total Commander" (Indicator: "software\ghisler\total commander") "\win.ini" (Indicator: "\win.ini") "\Ipswitch\WS_FTP" (Indicator: "\ipswitch\ws_ftp") "\GlobalSCAPE\CuteFTP" (Indicator: "\globalscape\cuteftp") "\GlobalSCAPE\CuteFTP Pro" (Indicator: "\globalscape\cuteftp pro") "\GlobalSCAPE\CuteFTP Pro" (Indicator: "\globalscape\cuteftp") "\GlobalSCAPE\CuteFTP Lite" (Indicator: "\globalscape\cuteftp") "Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar" (Indicator: "\globalscape\cuteftp") "Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar" (Indicator: "\globalscape\cuteftp") "Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar" (Indicator: "\globalscape\cuteftp") "Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar" (Indicator: "\globalscape\cuteftp") "Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar" (Indicator: "\globalscape\cuteftp") "Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar" (Indicator: "\globalscape\cuteftp") "\Quick.dat" (Indicator: "quick.dat") "Software\FlashFXP\3" (Indicator: "software\flashfxp") "Software\FlashFXP" (Indicator: "software\flashfxp") "Software\FlashFXP\4" (Indicator: "software\flashfxp") "Software\FileZilla" (Indicator: "software\filezilla") "Software\FileZilla Client" (Indicator: "software\filezilla") "FTP Navigator" (Indicator: "ftp navigator") "ftplist.txt" (Indicator: "ftplist.txt") "FTP Commander" (Indicator: "ftp commander") "Software\BPFTP\Bullet Proof FTP\Main" (Indicator: "software\bpftp") "Software\BPFTP\Bullet Proof FTP\Main" (Indicator: "software\bpftp\bullet proof ftp\main") "Software\BulletProof Software\BulletProof FTP Client\Main" (Indicator: "software\bulletproof software\bulletproof ftp client\main") "Software\BPFTP\Bullet Proof FTP\Options" (Indicator: "software\bpftp") "Software\BPFTP\Bullet Proof FTP\Options" (Indicator: "software\bpftp\bullet proof ftp\options")35:T4ad,Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonatePrivilege"; File: "00000000-00007224.00000000.229229.00401000.00000020.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonate"; File: "00000000-00007224.00000000.229229.00401000.00000020.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00007224.00000000.229229.00413000.00000004.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00007224.00000000.229229.00413000.00000004.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007224.00000000.229229.00413000.00000004.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonatePrivilege"; Source: "00000000-00007224.00000000.229229.00413000.00000004.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonate"; Source: "00000000-00007224.00000000.229229.00413000.00000004.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00007224.00000000.229229.00413000.00000004.mdmp")36:T569,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007224.00000000.229229.030D0000.00000004.mdmp, 00000000-00007224.00000001.231151.030D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"699a6f8ed1a7ce22b00c2c34"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00007224.00000001.231151.07970000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"699a6f8ed1a7ce22b00c2c34"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00007224.00000000.229229.030D0000.00000004.mdmp, 00000000-00007224.00000001.231151.030D0000.00000004.mdmp\")\n Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00007224.00000001.231151.07970000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"699a6f8ed1a7ce22b00c2c34"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"