{
  "family": "tpyn",
  "sample_count": 52,
  "category": "trojan",
  "description": "Tpyn (cataloged across security vendors and threat intelligence databases under signatures including Trojan:Win32/Tpyn, Backdoor:Win32/Tpyn, and Trojan.Tpyn) is a stealthy Windows trojan and initial access stager active since 2018. Designed to breach endpoint perimeter defenses and securely deliver secondary payloads, Tpyn functions as a staging tool for cybercrime syndicates. Upon execution, the malware profiles the host environment to detect analysis sandboxes or virtual machine hypervisors. If clean, Tpyn establishes persistence via Windows Registry Run keys or hidden scheduled tasks, hollows legitimate system processes such as explorer.exe or svchost.exe, and establishes encrypted HTTPS communications with remote command-and-control servers to download ransomware, banking trojans, or infostealers.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Tpyn",
    "Backdoor:Win32/Tpyn",
    "Trojan.Win32.Tpyn",
    "Win32/Tpyn",
    "HEUR:Trojan.Win32.Tpyn"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Tpyn?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Tpyn is a stealthy Windows trojan that acts as an initial access stager and dropper for secondary malware payloads."
      }
    },
    {
      "@type": "Question",
      "name": "How does Tpyn evade sandbox detection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It checks for hypervisor artifacts, virtual machine drivers, and sandbox indicators before unpacking its payload."
      }
    },
    {
      "@type": "Question",
      "name": "What process injection mechanisms are used by Tpyn?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It frequently injects its downloading routine into explorer.exe or svchost.exe to conceal outbound network beacons."
      }
    },
    {
      "@type": "Question",
      "name": "How is Tpyn typically distributed to target machines?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through malicious email attachments, cracked application downloads, and drive-by exploit kits."
      }
    },
    {
      "@type": "Question",
      "name": "How can security administrators detect and remove Tpyn?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Monitor anomalous process injection alerts, perform Microsoft Defender Offline scans, and clean Registry Run keys."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055",
    "T1497.001",
    "T1547.001",
    "T1105",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2018,
  "threat_actor": null,
  "delivery_mechanism": [
    "Malicious Phishing Attachments",
    "Exploit Kit Redirections",
    "Trojanized Freeware Downloads"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Host Sandbox & VM Detection",
    "Process Injection into explorer.exe",
    "Encrypted HTTPS C2 Beaconing",
    "Secondary Payload Ingestion",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      ".NET Compiled Binary"
    ],
    "network_signatures": [
      "Periodic HTTPS POST beacons transmitting encrypted machine GUIDs and OS version telemetry"
    ],
    "evasion_techniques": [
      "Injecting execution threads into legitimate system binaries (explorer.exe, svchost.exe)",
      "Executing anti-analysis timing checks and hypervisor driver queries"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "2b3e449a57291dc8f781bb49f8b15df726489312",
      "cf8194ad9271649275819385920a19e48b3b42f2"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\TpynClient"
    ],
    "file_paths": [
      "%AppData%\\Tpyn\\tpyn.exe",
      "%Temp%\\stage2_payload.bin"
    ]
  },
  "defensive_measures": [
    "Deploy endpoint detection rules for anomalous process injection into explorer.exe",
    "Enforce outbound SSL/TLS traffic inspection to intercept C2 beacons",
    "Block unsigned binaries executing from user temp profiles"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Tpyn",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Tpyn"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan:Win32/Tpyn!rfn",
      "Backdoor:Win32/Tpyn.A"
    ]
  },
  "motivation": "Initial Access Provisioning & Secondary Malware Delivery",
  "sample_hashes": []
}