Trojan-PSW.Win32.Tepfer.psyyfn (file analysis)

The Trojan-PSW.Win32.Tepfer.psyyfn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan-PSW.Win32.Tepfer.psyyfn virus can do?

Behavioural detection: Executable code extraction – unpacking
CAPE extracted potentially suspicious content
Drops a binary and executes it
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Trojan-PSW.Win32.Tepfer.psyyfn?


File Info:
name: 34B76B29367D02F10063.mlw
path: /opt/CAPEv2/storage/binaries/f326e0398b01b3a30affd57f87659f02496ceccb0c1852590f19e227cd8a0e0a
crc32: 67E13790
md5: 34b76b29367d02f1006372aa3fe796a8
sha1: ca5c10ee25ca2cf6f91263850fb2b8c1bb7ed59a
sha256: f326e0398b01b3a30affd57f87659f02496ceccb0c1852590f19e227cd8a0e0a
sha512: 0c13f7cb445aac027affc8d1da6b1b122c65c811890da32e4a5525b0735f3bc377896e70b9c8f60cd850dcdd394d0531a57f04d67294abbce0740420e8010433
ssdeep: 12288:xaDef9JkEeNkSNKc060WWwkiCqqysgfBnnl2:wfEk/kiCqqysgpnnc
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T170B4492877EC8B67E5AE07B89074415143F7AD52563BDB4E7C8D20EE2F637808A20767
sha3_384: 4a0bd3d0a12e283ad9a27ede862259452607c918c870bf0f7064111ef694120872604e1a99e3e7a51bec029745a436bf
ep_bytes: 689c484000e8f0ffffff000000000000
timestamp: 2012-07-16 15:14:37

Version Info:
Translation: 0x0409 0x04b0
Comments: OCSClient v5.0
CompanyName: www.download-sponsor.de
LegalCopyright: Copyright @ www.download-sponsor.de
ProductName: OCSClient
FileVersion: 1.00
ProductVersion: 1.00
InternalName: ocsclient
OriginalFilename: ocsclient.exe

Trojan-PSW.Win32.Tepfer.psyyfn also known as:

Bkav	W32.AIDetect.malware2
Lionic	Heuristic.File.Generic.00×1!p
Elastic	malicious (high confidence)
ClamAV	Win.Dropper.LokiBot-6991918-0
FireEye	Generic.mg.34b76b29367d02f1
CAT-QuickHeal	Downldr.DwnldSpnsr.S194047
Malwarebytes	PUP.Optional.DownloadSponsor
K7AntiVirus	Adware ( 004bc9fd1 )
K7GW	Adware ( 004bc9fd1 )
CrowdStrike	win/grayware_confidence_100% (D)
Cyren	W32/Downloader.UC.gen!Eldorado
SymantecMobileInsight	AppRisk:Generisk
ESET-NOD32	a variant of Win32/DownloadSponsor.A potentially unwanted
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Trojan-PSW.Win32.Tepfer.psyyfn
NANO-Antivirus	Riskware.Win32.dfmtmt.eaqejw
SUPERAntiSpyware	PUP.DownloadSponsor/Variant
Emsisoft	Application.Downloader (A)
F-Secure	PotentialRisk.PUA/DownloadSponsor.Gen
DrWeb	Adware.Downware.2256
Zillya	Downloader.DownloadSponsor.Win32.8
Trapmine	malicious.high.ml.score
SentinelOne	Static AI – Malicious PE
GData	Win32.Application.DownloadSponsor.W
Jiangmin	Downloader.DownloadSponsor.e
Avira	PUA/DownloadSponsor.Gen
Antiy-AVL	Trojan/Win32.TSGeneric
ZoneAlarm	Trojan-PSW.Win32.Tepfer.psyyfn
Microsoft	Backdoor:Win32/Bladabindi!ml
Google	Detected
VBA32	Downware.VB.AndreClient
Cylance	Unsafe
Rising	PUA.DownloadSponsor!8.222 (CLOUD)
Yandex	Riskware.Agent!Dl8UnobsXGg
Ikarus	PUA.DownloadSponsor
MaxSecure	not-a-virus:Trojan.DownloadSponsor
Cybereason	malicious.e25ca2

How to remove Trojan-PSW.Win32.Tepfer.psyyfn?

Trojan-PSW.Win32.Tepfer.psyyfn removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X