MALICIOUS — 026_Backdoor.MSIL.Tyupkin.bin

MALICIOUS — 026_Backdoor.MSIL.Tyupkin.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Jalapeno family. 5 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 16166533c69f2f04110e8b8e9cc45ed2aeaf7850fa68845c64d92ff907dd44f0
• SHA-1: bfa9791ccc407819907b9d38341dd6d50b663e55
• MD5: 700e91a24f5cadd0cb7507f0d0077b26
• imphash: 8c88f3b40d30af1bb7b9ff30f1d44842
• ssdeep: 3072:B77jEZKhCCyFcUjisS4ImRuCdtId2kf7eyg91WBuCdEkOrSmUCqQelwkqsJfee7:WZlFcUjisS4ImRuCdtId2kf7eyg91WB
• TLSH: T1743C7D71E25D65E9F69BFD021CE5E55CBA036A0FD8A2D926417443F2CDA88033236C4B
• Submitted as: 026_Backdoor.MSIL.Tyupkin.bin
• File type: pe · Size: 118784 bytes
• Verdict: malicious (98/100) · Family: Jalapeno

Detections (5 of 52 engines)

• YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
• Cyble Vision: Cyble Vision: Malicious
• Microsoft Defender: Backdoor:MSIL/Sidkey.A
• Emsisoft (Emergency Kit): Gen:Variant.Jalapeno.12385
• Kaspersky (KVRT): Backdoor.MSIL.Tyupkin.c

MITRE ATT&CK

• T1547.001

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

• Cyble Vision flagged Cyble Vision: Malicious (rule Cyble Vision: Malicious) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Backdoor:MSIL/Sidkey.A (rule Backdoor:MSIL/Sidkey.A) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Jalapeno.12385 (rule Gen:Variant.Jalapeno.12385) - engine signal, weight 0.55, confidence 0.85
• YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

More Jalapeno samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report