MALICIOUS — 868_Win32.Turla.bin

MALICIOUS — 868_Win32.Turla.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (87/100), attributed to the Turla family. 3 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 9611d0b1837e933b9d938e19791b757aa56669ec75b8fd671bdd1371eede03bb
SHA-1: 41d72fa626cccadcd5aae3a0a652043e4a4f7b4a
MD5: 3c1a8991e96f4c56ae3e90fb6f0ae679
imphash: 4fae43ad5c1879f36a587f2233412536
ssdeep: 192:ZcMdjzlmeno/hERhFXmIoozoZSiLpeaencO+MX1gcT:OMdjzIWRhFWIoozo4iFGnhg
TLSH: T1EA2A184AACB56406FD53F334B1884E4D2D52246E2A7FD55A1391F42772AAC4B708C7F0
Submitted as: 868_Win32.Turla.bin
File type: pe · Size: 20480 bytes
Verdict: malicious (87/100) · Family: Turla

Detections (3 of 52 engines)

Microsoft Defender: Backdoor:Win32/Turla.V!dha
Emsisoft (Emergency Kit): Gen:Variant.Ulise.305368
Kaspersky (KVRT): Backdoor.Win32.Turla.bp

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 87/100 is the fusion of 4 weighted signals:

Microsoft Defender flagged Backdoor:Win32/Turla.V!dha (rule Backdoor:Win32/Turla.V!dha) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Ulise.305368 (rule Gen:Variant.Ulise.305368) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Turla.bp (rule Backdoor.Win32.Turla.bp) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

98 behavior events · 1 ATT&CK techniques · 0 dropped files.

Embedded domains

inference.location.live.net

More Turla samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report