SecuriteInfo.com.Win32.PWSX-gen.32566.31866
Classification: Malicious
SecuriteInfo.com.Win32.PWSX-gen.32566.31866 is a trojan (Windows executable, 788.5 KB). Detected by 88 antivirus engines. Linked to Turla activity.
Detection summary
- 88 antivirus detections
- 1 IDS alerts
- 2 processes observed
- 4 contacted hosts
- 5 DNS requests
MITRE ATT&CK associations
Intrusion sets: TURLA (G0010)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Snake | ThreatFox Abuse.ch | 2025-02-20 09:37:16 | 2025-02-22 09:44:43 | G0010 Turla | |
| Generic Malware | Hybrid-Analysis | 2024-02-06 09:45:03 | 2024-02-06 09:45:03 | ||
| SnakeKeylogger | MalwareBazaar Abuse.ch | 2024-02-06 09:23:18 | 2024-02-06 09:23:18 | malicious-activity |
Tags
win.snake ekans snakehoseSample information
- Filenames
- SecuriteInfo.com.Win32.PWSX-gen.32566.31866
- File type
- PE32 executable (GUI) Intel 80386 Mono/.Net assemb ...
- Size
- 807424 bytes
- MD5
388be34beafa1b9101d8e696f8feccf5- SHA-1
30f55d15f98f458cbba49b164e9177d382096c7d- SHA-256
0362ca22d88c46b40010c8d847a769ff5942df7071968f00911a41b59e1a59a5- First indexed
- 2024-02-06 09:30:13
- Last updated
- 2026-10-07 14:25:55
Antivirus detections
| Engine | Detection |
|---|---|
| ALYac | Trojan.GenericKDZ.105486 |
| APEX | Malicious |
| AVG | Win32:PWSX-gen [Trj] |
| AhnLab-V3 | Trojan/Win.PWSX-gen.C5585346 |
| Alibaba | Trojan:MSIL/Remcos.5a3948b2 |
| Arcabit | Trojan.Generic.D19C0E |
| Avast | Win32:PWSX-gen [Trj] |
| Avira | HEUR/AGEN.1371115 |
| BitDefender | Trojan.GenericKDZ.105486 |
| CAT-QuickHeal | Trojan.Ghanarava.1712263591feccf5 |
| CTX | exe.trojan.msil |
| ClamAV | Win.Packed.Formbook-10020621-0 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cylance | Unsafe |
| DeepInstinct | MALICIOUS |
| DrWeb | Trojan.PackedNET.2511 |
| ESET-NOD32 | a variant of MSIL/Kryptik.AKVL |
| Elastic | malicious (high confidence) |
| Emsisoft | Trojan.GenericKDZ.105486 (B) |
| F-Secure | Heuristic.HEUR/AGEN.1371115 |
| FireEye | Trojan.GenericKDZ.105486 |
| Fortinet | MSIL/GenKryptik.GTLY!tr |
| GData | MSIL.Trojan.PSE.1DO0MY |
| Detected | |
| Ikarus | Tojan.MSIL.Inject |
| K7AntiVirus | Riskware ( 00584baa1 ) |
| K7GW | Riskware ( 00584baa1 ) |
| Kaspersky | HEUR:Trojan.MSIL.Crypt.gen |
| Kingsoft | MSIL.Trojan.Crypt.gen |
| Lionic | Trojan.Win32.Crypt.4!c |
| Malwarebytes | Trojan.MalPack.PNG.Generic |
| MaxSecure | Trojan.Malware.11716371.susgen |
| McAfee | Artemis!388BE34BEAFA |
| McAfeeD | ti!0362CA22D88C |
| MicroWorld-eScan | Trojan.GenericKDZ.105486 |
| Microsoft | Trojan:MSIL/Remcos.KAAJ!MTB |
| NANO-Antivirus | Trojan.Win32.Crypt.kjfuow |
| Paloalto | generic.ml |
| Panda | Trj/Chgt.AD |
| Rising | Malware.Obfus/[email protected] (RDM.MSIL2:3DyYM6jamI96cLA5Pmo6uw) |
| Sangfor | Suspicious.Win32.Save.a |
| SentinelOne | Static AI - Malicious PE |
| Skyhigh | BehavesLike.Win32.Generic.bc |
| Sophos | Troj/Krypt-ABH |
| Symantec | Scr.Malcode!gdn33 |
| Tencent | Msil.Trojan.Crypt.Nzfl |
| VBA32 | TrojanLoader.MSIL.DaVinci.Heur |
| VIPRE | Trojan.GenericKDZ.105486 |
| Varist | W32/MSIL_Kryptik.KNS.gen!Eldorado |
| ViRobot | Trojan.Win.Z.Kryptik.807424.C |
| VirIT | Trojan.Win32.MSIL_Heur.A |
| Webroot | W32.Trojan.Gen |
| Xcitium | Malware@#1zdwkif0nqa5o |
| Zillya | Trojan.Kryptik.Win32.4504389 |
| Zoner | Trojan.Win32.168927 |
| huorong | Trojan/MSIL.Agent.gb |
| AVG | FileRepMalware [Trj] |
| Avast | FileRepMalware [Trj] |
| Bkav | W32.AIDetectMalware.CS |
| Cylance | unsafe |
| Cynet | Malicious (score: 100) |
| Kaspersky | UDS:Trojan-Spy.MSIL.SnakeLogger.gen |
| Lionic | Trojan.Win32.SnakeLogger.l!c |
| Malwarebytes | MachineLearning/Anomalous.97% |
| Microsoft | Trojan:Win32/Wacatac.B!ml |
| Symantec | Trojan.Gen.MBT |
| ZoneAlarm | UDS:Trojan-Spy.MSIL.SnakeLogger.gen |
| ALYac | Gen:Variant.Jalapeno.2992 |
| AVG | Win32:MalwareX-gen [Pws] |
| Antiy-AVL | Trojan/MSIL.Kryptik |
| Arcabit | Trojan.Jalapeno.DBB0 |
| Avast | Win32:MalwareX-gen [Pws] |
| Avira | TR/W32.MalwareX |
| BitDefender | Gen:Variant.Jalapeno.2992 |
| Bkav | W32.Common.4301E69C |
| ESET-NOD32 | MSIL/Kryptik.AKVL trojan |
| Emsisoft | Gen:Variant.Jalapeno.2992 (B) |
| F-Secure | Trojan.TR/W32.MalwareX |
| McAfeeD | Trojan:Win/Stealer.JI |
| MicroWorld-eScan | Gen:Variant.Jalapeno.2992 |
| Rising | Malware.Obfus/[email protected] (RDM.MSIL2:FUr1qk140+z3ZSQzmQ+HIA) |
| Skyhigh | BehavesLike.Win32.Trojan.bc |
| Tencent | Malware.Win32.Gencirc.1495cc6a |
| TrellixENS | Artemis!388BE34BEAFA |
| TrendMicro-HouseCall | Trojan.Win32.VSX.PE04CA1 |
| VIPRE | Gen:Variant.Jalapeno.2992 |
| ZoneAlarm | Troj/Krypt-ABH |
| alibabacloud | Trojan:MSIL/AgentTesla.AZHO3DGW |
Network contacts
DNS requests
aborters.duckdns.org aborters.duckdns.org:8081 checkip.dyndns.org reallyfreegeoip.org varders.kozow.com
Process list
| Name | Command line |
|---|---|
| SecuriteInfo.com.Win32.PWSX-gen.32566.31866.exe | |
| MSBuild.exe | |