{
  "family": "zepfod",
  "sample_count": 46,
  "category": "trojan",
  "description": "Zepfod is a stealthy Windows trojan downloader and reconnaissance agent active since 2015. Distributed via malicious email attachments, cracked gaming packages, and affiliate download wrappers, Zepfod serves as an initial access stager on compromised endpoints. Once launched, Zepfod interrogates the host operating system, gathering system architecture, installed security software, locale, and network configuration. It establishes persistent autostart entries in the Windows registry under CurrentVersion\\Run and initiates encrypted HTTP/TCP beacons to remote command-and-control servers, downloading and executing secondary malicious payloads such as cryptocurrency miners, infostealers, or backdoor components.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Zepfod",
    "Trojan.Win32.Zepfod",
    "TrojanDownloader:Win32/Zepfod",
    "Win32/Zepfod"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Zepfod?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Zepfod is a stealthy Windows trojan downloader that profiles target computers and drops secondary malware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Zepfod compromise endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through malicious email attachments, cracked software packages, and affiliate download bundles."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary malware is commonly staged by Zepfod?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It frequently downloads cryptocurrency miners, credential stealers, and remote access trojans."
      }
    },
    {
      "@type": "Question",
      "name": "How does Zepfod maintain startup persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It writes autostart entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be disinfected from Zepfod?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Quarantine the file with Microsoft Defender, delete startup registry entries, and clear temporary extraction folders."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1547.001",
    "T1105",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.004",
      "name": "Impair Defenses: Disable or Modify System Firewall",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint; the aggressive system modifications make the machine fundamentally untrustworthy and likely open to secondary payloads.",
    "Utilize EDR or offline registry analysis tools to identify and reverse the malicious registry modifications (especially those disabling security tools).",
    "Audit the `HOSTS` file (`C:\\Windows\\System32\\drivers\\etc\\hosts`) and remove any entries redirecting security vendor domains to `127.0.0.1`.",
    "Due to the depth of the system modifications, the most secure remediation is a complete, clean rebuild of the operating system."
  ],
  "what_to_avoid": [
    "Do not trust the endpoint's built-in security tools or logs; a Zepfod infection is explicitly designed to disable or tamper with these mechanisms.",
    "Avoid relying solely on automated AV removal, as the malware may have replaced legitimate system files that AV cannot safely delete."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Initial Access & Malware Distribution",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2015,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Email Attachments",
    "Cracked Software & Keygens",
    "Deceptive Download Wrappers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Host Profile Reconnaissance",
    "Secondary Payload Downloading",
    "Registry Autostart Persistence",
    "Encrypted C2 Communication",
    "Antivirus Process Detection"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP POST beacons reporting host GUIDs and installed security tools to remote C2 IP endpoints",
      "HTTP GET requests downloading encrypted secondary binaries into %Temp%"
    ],
    "evasion_techniques": [
      "Delaying execution loops to bypass automated sandbox analysis",
      "Obfuscating internal string literals with XOR encoding",
      "Randomized filename generation in %AppData%"
    ],
    "indicators": {
      "file_paths": [
        "%AppData%\\Zepfod\\zepfod_stager.exe",
        "%Temp%\\stage2_miner.exe"
      ],
      "registry_keys": [
        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ZepfodStager"
      ]
    }
  },
  "severity": "high",
  "lineage": {
    "derived_from": [
      "Zepfod Downloader Framework"
    ],
    "variants": [
      "Zepfod.A",
      "Zepfod.Downloader"
    ]
  },
  "iocs": {
    "file_hashes": [
      "ee55ff6677889900aabbccddeeff11223344556677889900aabbccddeeff1122",
      "ff6677889900aabbccddeeff11223344556677889900aabbccddeeff11223344"
    ],
    "delivery": [
      "invoice_payment_advice.exe",
      "office_patch_installer.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ZepfodStager"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Zepfod",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Zepfod"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.ZEPFOD",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.zepfod"
    }
  ]
}