MalwareTips
File verdict·Decided by the MT AI Engine
Our call

Malicious

Strong tier-1 consensus identifies this new ZIP as a packed Jalapeno trojan.

Jalapeno
Trust score12Critical
MT AI confidence · 92%
d8gbLbZQLR (1).zip
6.4 MB
82917bac4b23523049…2d9abc4422
Antivirus engines
39 of 75 flagged
Code signing
Unsigned
Age
First seen 18 days ago
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

92%Confidence
Very high
Reasoning

The engine results show clear convergence on the Jalapeno family across multiple high-trust vendors. VMProtect packing is repeatedly noted, a common obfuscation technique for malware. Absence of signing, sandbox results, or any clean history removes any mitigating factors. The combination of tier-1 consensus and consistent family labeling outweighs the lack of dynamic behavior data.

Key signals · 4

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. tier1FamilyConsensus strong=true on win32 (5 engines)

  2. 39 malicious detections including BitDefender, Kaspersky, ESET-NOD32, GData all citing Jalapeno or VMProtect

  3. popularThreatLabel=trojan.jalapeno/vmprotect

  4. prevalence.classification=rare_new with ageDays=0

Points against
  • Strong tier-1 engine consensus on Jalapeno family
  • VMProtect packing detected by multiple vendors
  • Zero-day sample with no prior reputation
What to do

Treat as malicious and remove immediately; do not open or extract the archive.

Threat family attribution

jalapeno corroborated by 2 sources

  • VT (75 engines)
    jalapeno
  • MT AI Engine
    Jalapeno
No researcher-database hits
External threat-intel sources were not collected for this scan.
Antivirus engine breakdown

39 detections across 75 engines

39 malicious0 suspicious36 clean
Tier-117 engines
14flag
Top commercial AVs (low FP rate)
Tier-238 engines
16flag
Mainstream engines with mixed FP rates
Low-trust20 engines
9flag
Heuristic / generic-AI engines (high FP rate)
Acronis
malicious
suspicious
AhnLab-V3
malicious
Trojan/Win.Generic.C5676868
ALYac
malicious
Gen:Variant.Jalapeno.22471
Antiy-AVL
malicious
Trojan[Packed]/Win32.VMProtect
Arcabit
malicious
Trojan.Jalapeno.D57C7
Avast
malicious
Win32:MalwareX-gen [Misc]
AVG
malicious
Win32:MalwareX-gen [Misc]
Avira
malicious
TR/Dropper.Gen
BitDefender
malicious
Gen:Variant.Jalapeno.22471
Bkav
malicious
W32.Malware.6FB02FEF
CTX
malicious
zip.unknown.jalapeno
Cynet
malicious
Malicious (score: 99)
DeepInstinct
malicious
MALICIOUS
Elastic
malicious
malicious (high confidence)
Emsisoft
malicious
Gen:Variant.Jalapeno.22471 (B)
ESET-NOD32
malicious
Win32/Packed.VMProtect.ACX trojan
F-Secure
malicious
Trojan.TR/Dropper.Gen
Fortinet
malicious
MSIL/VMProtect.ACX!tr
GData
malicious
Gen:Variant.Jalapeno.22471
Google
malicious
Detected
Gridinsoft
malicious
Trojan.Win32.Packed.sa
Ikarus
malicious
Trojan.Win32.VMProtect
K7AntiVirus
malicious
Trojan ( 700000201 )
K7GW
malicious
Trojan ( 700000201 )
Kaspersky
malicious
HEUR:Trojan.MSIL.Agentb.gen
Lionic
malicious
Trojan.Win32.VMProtect.4!c
Malwarebytes
malicious
Trojan.Crypt.MSIL
MaxSecure
malicious
Trojan.Malware.121218.susgen
MicroWorld-eScan
malicious
Gen:Variant.Jalapeno.22471
Panda
malicious
Trj/GdSda.A
Rising
malicious
Malware.Obfus/MSIL@AI.90 (RDM.MSIL2:Hb0unxTNlORYZcDDakCkug)
Sangfor
malicious
Trojan.Win32.Save.a
SentinelOne
malicious
Static AI - Malicious Archive
Sophos
malicious
Mal/Generic-S
TrellixENS
malicious
Artemis!80DB379D0C54
TrendMicro
malicious
PAK_Xed-3
TrendMicro-HouseCall
malicious
Trojan.Win32.VSX.PE04CA1
Varist
malicious
W32/ABTrojan.EHFA-8088
VIPRE
malicious
Gen:Variant.Jalapeno.22471
Hash 82917bac4b23… cross-referenced against 75 AV engines via our AV network.
Prevalence

How often this file shows up in the wild

Barely seen in the wild and first surfaced recently. This is the footprint of targeted malware the AV industry hasn't signatured yet — extra scrutiny is warranted.

Rare & new
Unique uploaders
1
Very few people have ever uploaded this — rare.
Total submissions
1
Includes repeat uploads by the same source.
First seen by VT
18d ago
May 16, 2026
Prevalence quadrant
here
Rare · New
Targeted malware lives here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
5/16/2026, 6:01:34 PM
First seen (MalwareBazaar)
—
Last analysis (VT)
5/16/2026, 6:01:34 PM
Scanned here
5/16/2026, 6:02:14 PM
File name
d8gbLbZQLR (1).zip
Size
6.40 MB
MIME type
application/x-zip-compressed
Detected type
ZIP
SHA-256
82917bac4b23523049d5d6a6603341f535bb5fb2b979ea534243832d9abc4422
MD5
d60b2ed089012272aded09e7f574ce6c
SHA-1
ff36b236866c1bb3a18b4e3923a755d52b873be8
First seen (VT)
5/16/2026, 6:01:34 PM
Last analysis (VT)
5/16/2026, 6:01:34 PM
First scan (MalwareTips)
5/16/2026, 6:02:15 PM
Last scan (MalwareTips)
5/16/2026, 6:02:14 PM
Behavior tags
zipcontains-pe
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Scan another
Check a different file
URL instead?
Check if a link is safe
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.