Retefe (Windows)Malware
- Tsukuba
- werdlod
Retefe is a Windows Banking Trojan that can also download and install additional malware onto the system using Windows PowerShell. It's primary functionality is to assist the attacker with stealing credentials for online banking websites. It is typically targeted against Swiss banks.From MISP Galaxy
Last reported 9 years ago, by Group-IB1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1036Masquerading
“Masquerading as Russian hackers”
- T1556.005Reversible Encryption
“…ions designed to “unpack” SSL encrypted traffic, Backend_Listener encrypts all data sent over an SSL channel using an additional reversible encryption algorithm and performs legitimacy tests.”
What the reports say
1 report, newest first · the exact sentence from each-
LAZARUS ARISEN“VPN: the attackers installed SoftEther VPN (hxxp://softether.net/) service supported by University of Tsukuba, Japan on some servers to unsure additional level of anonymity.”
Indicators in its reports
named in the reports above- 210.52.109[.]22in 1 report
- 175.45.178[.]222in 1 report
- 175.45.178[.]19in 1 report
- 175.45.178[.]97in 1 report
- server[.]itin 1 report
- cnvb.gob[.]mxin 1 report
- brou.com[.]uyin 1 report
- hxxp://softether[.]net/in 1 report
- softether[.]netin 1 report
Copy these 9 indicators · defanged
Thanks — we review every report.