Retefe

Overview

Trojan:Win32/Retefe is a highly sophisticated, targeted Banking Trojan known for its unique and complex execution chain. Highly active in the mid-to-late 2010s, Retefe primarily targeted banking customers in Switzerland, Austria, Sweden, and the UK. Unlike traditional banking trojans that use process injection for web-injects, Retefe relies on aggressive modification of the victim's proxy settings (PAC files) to hijack banking traffic and route it through the Tor network to attacker-controlled servers.

Understanding Retefe
To an infected user, Retefe is invisible until they attempt to log into their bank. At that point, they are seamlessly served a fake, pixel-perfect replica of the banking site, often designed to bypass two-factor authentication (e.g., asking for an SMS code). For a security analyst, Retefe is a masterclass in 'Living off the Land'. It relies heavily on PowerShell, JavaScript, and legitimate administrative tools to execute its attack, rather than traditional compiled C/C++ malware, making it highly evasive.

Execution and Proxy Hijacking Mechanics
Retefe is typically distributed via spearphishing emails containing malicious Word documents (macro-enabled) or ZIP files containing heavily obfuscated JavaScript droppers (`T1566.001`). When the user executes the file, it launches PowerShell (`T1059.001`). The PowerShell script performs several actions: it downloads and silently installs Tor or Socat (`T1105`), installs a rogue root CA certificate into the Windows Certificate Store (`T1552.004`) (to prevent SSL warnings during the attack), and crucially, modifies the system's Proxy Auto-Configuration (PAC) script settings (`T1562.001`). This malicious PAC file instructs the browser that any traffic destined for targeted banking URLs must be routed through the newly installed Tor proxy (`T1090.003`). The Tor proxy connects to the attacker's server, which serves the fake banking pages (Man-in-the-Middle).

Indicators of Compromise & Impact
The impact is severe financial fraud. Detection focuses on configuration changes rather than malware files. Incident responders should look for unauthorized modifications to the proxy settings (PAC URL) in the Registry or Internet Options. EDR logs will flag the execution of heavily obfuscated PowerShell scripts and the silent installation of unknown Root Certificates. Network logs may show connections to the Tor network originating from non-browser processes.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1059.001: Restrict execution of PowerShell. Enforce PowerShell Constrained Language Mode and Script Block Logging.
• T1185: Enforce strong MFA and use browser isolation or hardened browsers for sensitive financial or administrative portals to defeat session hijacking.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_RETEFE {
    meta:
        description = "Detects Retefe (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "retefe" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Retefe Activity
id: 30840b9fe1e917de686b307cf870599a
status: experimental
description: Detects generic indicators of the retefe malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*retefe*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint; the attacker is actively performing Man-in-the-Middle attacks on the user's web traffic.
2. Remove the malicious Proxy Auto-Configuration (PAC) script from Windows Internet Options and Registry (`HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings`).
3. Audit the Windows Certificate Store (certmgr.msc) and remove any unauthorized Root CA certificates installed by the malware.
4. Enforce immediate enterprise-wide password resets for the affected user, assuming all typed credentials have been compromised.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume changing passwords is sufficient; if the rogue Root CA and malicious PAC file are not removed, the attacker will immediately steal the new passwords.
2. Avoid relying solely on file-based antivirus, as Retefe's core logic often relies on native Windows scripting (PowerShell) and configuration changes.

References & External Analysis

• Search "retefe" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Tsklnk
• Plinch
• Bindjpg
• Murofet
• Sasfis

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/retefe.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.