MALICIOUS — decrypted_inj_snake_x64.dll

MALICIOUS — decrypted_inj_snake_x64.dll is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (90/100), attributed to the Turla family. 5 of 51 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 152c867667517a0ec0b3231beece8ff46ff954bfc2493ca3bdfdfc6ea6b1bde9
SHA-1: 1cf6e12df0d786934c2ad5b706f4f8795f776c8b
MD5: 2b47ad7df9902aaa19474723064ee76f
imphash: 1f5d96e70307ba172e6019c6a75eba0d
ssdeep: 6144:UjME1yJklXBSsDLnsajEIAmzXCNA0FBLNxxh0YaNDBnSW+otS1CZOpM9Hm7:w1flXBSYLemrONxxh0dNEwsCFH
TLSH: T1CE4C7D6141177611F5F6FA74AC10DECC8853B29CA0B61DCC5303EA5E94E9AB783E068B
Submitted as: decrypted_inj_snake_x64.dll
File type: pe · Size: 520185 bytes
Verdict: malicious (90/100) · Family: Turla

Detections (5 of 51 engines)

MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
YARA: JPCERT/CC: JPCERT_Emotet
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Backdoor:Win32/Turla.V!dha
Emsisoft (Emergency Kit): Trojan.Generic.11331260

MITRE ATT&CK

Why this verdict

The malicious score of 90/100 is the fusion of 8 weighted signals:

Microsoft Defender flagged Backdoor:Win32/Turla.V!dha (rule Backdoor:Win32/Turla.V!dha) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Generic.11331260 (rule Trojan.Generic.11331260) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_Emotet (rule JPCERT_Emotet) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

61 behavior events · 1 ATT&CK techniques · 1 dropped files.

Dropped files

a1534442ac4481d1eecd623fc254a2ccb720748f8bf38ff2a05ce4bb2872d013 - a1534442ac4481d1eecd623fc254a2ccb720748f8bf38ff2a05ce4bb2872d013

Embedded domains

aefd.nelreports.net

More Turla samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report