Static task
static1
Behavioral task
behavioral1
Sample
Backdoor.Win32.Tyupkin.h.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Backdoor.Win32.Tyupkin.h.exe
Resource
win10v2004-20240802-en
General
-
Target
Backdoor.Win32.Tyupkin.h.exe
-
Size
120KB
-
MD5
250b77dfbb1b666e95b3bcda082de287
-
SHA1
5a699a8f64046d3d7fb5014d0242c159a04b8eed
-
SHA256
3639e8cc463922b427ea20dce8f237c0c0e82aa51d2502c48662e60fb405f677
-
SHA512
1bcc273ab504729928953c4d036286194a2ab3abb8ca9afe648cf01bce8895154308f9cbeb2b925196aa87f8e7821e40c3560e1d7703da3852ef7457e817218d
-
SSDEEP
3072:cAVBCZJlDSFqUjJsS4ImRuCdtId2kf7eyg91WBuCdEkOrSmUCqQelwkqsJfee7Wy:eZJAFqUjJsS4ImRuCdtId2kf7eyg91W3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Backdoor.Win32.Tyupkin.h.exe
Files
-
Backdoor.Win32.Tyupkin.h.exe.exe windows:4 windows x86 arch:x86
dce35d5cbbd93b3804f789439733cd0a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcr80
srand
rand
printf
_strdup
exit
wcstombs
mbstowcs
remove
wprintf
_cexit
_amsg_exit
__FrameUnwindFilter
_time64
_localtime64
_invalid_parameter_noinfo
__CxxUnregisterExceptionObject
__CxxQueryExceptionSize
__CxxDetectRethrow
__CxxRegisterExceptionObject
__CxxExceptionFilter
_CxxThrowException
??0exception@std@@QAE@XZ
??_V@YAXPAX@Z
??_U@YAPAXI@Z
??2@YAPAXI@Z
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
_crt_debugger_hook
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
??3@YAXPAX@Z
??0exception@std@@QAE@ABV01@@Z
memmove_s
?what@exception@std@@UBEPBDXZ
msvcp80
?length@?$char_traits@D@std@@SAIPBD@Z
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
?good@ios_base@std@@QBE_NXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBEHXZ
?width@ios_base@std@@QAEHH@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?uncaught_exception@std@@YA_NXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
kernel32
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetLastError
SetFileAttributesW
Sleep
FreeLibrary
GetProcAddress
LoadLibraryW
user32
SetFocus
ExitWindowsEx
ShowWindow
GetSystemMetrics
GetActiveWindow
msxfs
WFSOpen
WFSStartUp
WFSExecute
WFSFreeResult
WFSGetInfo
WFSCleanUp
WFSClose
WFSIsBlocking
shell32
SHGetFolderPathW
ShellExecuteW
advapi32
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegSetValueExW
RegDeleteValueW
RegCloseKey
RegOpenKeyExW
ole32
CoUninitialize
CoInitialize
CoCreateInstance
msvcm80
?ThrowNestedModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVException@System@@0@Z
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@P$AAVException@3@@Z
?DoDllLanguageSupportValidation@<CrtImplementationDetails>@@YAXXZ
?RegisterModuleUninitializer@<CrtImplementationDetails>@@YAXP$AAVEventHandler@System@@@Z
?_beginthreadex@@YAIPAXIP6MI0@Z0IPAI@Z
?DoCallBackInDefaultDomain@<CrtImplementationDetails>@@YAXP6GJPAX@Z0@Z
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@@Z
mscoree
_CorExeMain
Sections
.text Size: 32KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 72KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ