A forum for reverse engineering, OS internals and malware analysis 

Tyupkin source code

Forum for analysis and discussion about malware.
 Topic locked

Tyupkin source code

 #26235  by ThreatDetectors
 Sat Jul 04, 2015 4:28 pm
This is very interesting. I have been scanning through a lot of these samples and this code seems to be very adaptive. Is there a way to get the source to potentially reverse engineer it for future ATM defense?

Re: Win32/Tyupkin (ATM Malware, alias: Ulssm, Sidkey)

 #26237  by EP_X0FF
 Sun Jul 05, 2015 3:54 am
ThreatDetectors wrote: Is there a way to get the source to potentially reverse engineer it for future ATM defense?
Do you mean potentially write a clone? :)

Re: Win32/Tyupkin (ATM Malware, alias: Ulssm, Sidkey)

 #26270  by ThreatDetectors
 Mon Jul 13, 2015 1:51 am
EP_X0FF wrote:
ThreatDetectors wrote: Is there a way to get the source to potentially reverse engineer it for future ATM defense?
Do you mean potentially write a clone? :)

No not at all, this isn't of our nature. But instead to potentially be ahead. I currently develop firewalls for ATM security and I feel it would help to have a complete source just to know exactly how it does penetrate our systems.

Re: Win32/Tyupkin (ATM Malware, alias: Ulssm, Sidkey)

 #26274  by EP_X0FF
 Mon Jul 13, 2015 8:19 am
How does source of primitive virtual memory scraper related to "how it does penetrate our systems"? This is just a bot. Your system already penetrated by exploit or my criminal.

Re: Win32/Tyupkin (ATM Malware, alias: Ulssm, Sidkey)

 #26307  by ThreatDetectors
 Thu Jul 16, 2015 6:01 pm
EP_X0FF wrote:How does source of primitive virtual memory scraper related to "how it does penetrate our systems"? This is just a bot. Your system already penetrated by exploit or my criminal.
Hey,

I take no sides here man. Money is the motive, there is high demand for ATM security. Doesn't necessarily mean that I take the side of the good nor bad. Let me know if we could discuss the source.

Re: Win32/Tyupkin (ATM Malware, alias: Ulssm, Sidkey)

 #26313  by Xylitol
 Fri Jul 17, 2015 1:54 pm
ThreatDetectors wrote: there is high demand for ATM security.
Financial institutions don't need source code, they just dissassemble and write rules.
And related to this sample, it's know/detected since months now, a lot of people/companies already warned about this sample and took countermeasure, there is even probably a snort rule.
So since time... the mitigation is good now.
And you can still dissas samples with Reflector or similar MSIL tools, so it's not even a problem to have the code but there is absolutely no need and no reason in the meantime.
Honestly, if you can't even understand 'how it's work' without having a copy of the original source code (and this thread contains already a ton of infos/links), i think you can abandon your idea of firewall, it will fail.

Re: Win32/Tyupkin (ATM Malware, alias: Ulssm, Sidkey)

 #26327  by EP_X0FF
 Mon Jul 20, 2015 5:05 am
ThreatDetectors wrote: Let me know if we could discuss the source.
Unknown guy registered here for a less than 1 month and hiding behind TOR asks for source code of ATM malware for "good purposes". No, even if we have it, I highly doubt we will share it. Thread split and locked.
 Topic locked
 Return to “Malware”