ZiraatBankasi-20211118.exe
Classification: Malicious
ZiraatBankasi-20211118.exe is a trojan (application/x-dosexec). Detected by 96 antivirus engines. Linked to Turla activity. 3 sightings, last seen 2025-02-22.
Detection summary
- 96 antivirus detections
- 0 IDS alerts
- 0 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Intrusion sets: TURLA (G0010)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Snake | ThreatFox Abuse.ch | 2025-02-20 09:38:05 | 2025-02-22 09:40:18 | G0010 Turla | |
| SnakeKeylogger | Abuse.ch | 2021-11-18 08:51:43 | 2021-11-18 08:51:43 | malicious-activity | |
| Generic.Malware | Abuse.ch | 2021-11-18 08:51:43 | 2021-11-18 08:51:43 | malicious-activity |
Tags
win.snake ekans snakehoseSample information
- Filenames
- ZiraatBankasi-20211118.exe
- File type
- application/x-dosexec
- MD5
c95c03ddaad2aefec42f5d58b4fddb9b- SHA-1
12ab6f0d804450d6a66126abc59cc423b5ba59aa- SHA-256
0b0de2e9fb56c0313a746ebd10647957fc6465cd12d3d3ce1263ff34946be7ba- First indexed
- 2021-11-18 09:15:13
- Last updated
- 2026-10-12 04:40:27
Antivirus detections
| Engine | Detection |
|---|---|
| ALYac | Application.Generic.3107738 |
| APEX | Malicious |
| AVG | Win32:PWSX-gen [Trj] |
| AhnLab-V3 | Trojan/Win.Generic.C4777663 |
| Alibaba | Trojan:Win32/Kryptik.ali2000016 |
| Antiy-AVL | Trojan[Spy]/MSIL.Noon |
| Arcabit | Application.Generic.D2F6B9A |
| Avast | Win32:PWSX-gen [Trj] |
| Avira | HEUR/AGEN.1305579 |
| BitDefender | Application.Generic.3107738 |
| Bkav | W32.AIDetectMalware.CS |
| CAT-QuickHeal | Trojan.YakbeexMSIL.ZZ4 |
| CTX | exe.trojan.msil |
| ClamAV | Win.Dropper.LokiBot-10023938-0 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cylance | Unsafe |
| DeepInstinct | MALICIOUS |
| DrWeb | Trojan.DownLoader44.1885 |
| ESET-NOD32 | a variant of MSIL/Packed.Confuser.K suspicious |
| Elastic | malicious (high confidence) |
| Emsisoft | Trojan.Crypt (A) |
| F-Secure | Heuristic.HEUR/AGEN.1305579 |
| FireEye | Generic.mg.c95c03ddaad2aefe |
| Fortinet | MSIL/Injector.VTU!tr |
| GData | Application.Generic.3107738 |
| Detected | |
| Gridinsoft | Ransom.Win32.Gen.oa!s1 |
| Ikarus | Trojan.MSIL.Crypt |
| K7AntiVirus | Trojan ( 0058c9e81 ) |
| K7GW | Trojan ( 0058c9e81 ) |
| Kaspersky | HEUR:Trojan-Spy.MSIL.Noon.gen |
| Kingsoft | malware.kb.c.989 |
| Lionic | Trojan.Win32.Noon.l!c |
| Malwarebytes | Malware.AI.418307414 |
| MaxSecure | Trojan.Malware.73691310.susgen |
| McAfee | Artemis!C95C03DDAAD2 |
| McAfeeD | ti!0B0DE2E9FB56 |
| MicroWorld-eScan | Application.Generic.3107738 |
| Microsoft | Trojan:MSIL/AgentTesla.SM!MTB |
| Paloalto | generic.ml |
| Panda | Trj/GdSda.A |
| Rising | Malware.Obfus/[email protected] (RDM.MSIL2:KzWqi2TWqoxuLQfy8KYRoA) |
| Sangfor | Suspicious.Win32.Save.a |
| SentinelOne | Static AI - Malicious PE |
| Skyhigh | BehavesLike.Win32.AgentTesla.jc |
| Sophos | Mal/Generic-S |
| Symantec | Scr.Malcode!gdn34 |
| Tencent | Malware.Win32.Gencirc.141cbdd2 |
| Trapmine | malicious.moderate.ml.score |
| TrendMicro | TROJ_GEN.R002C0DBK25 |
| TrendMicro-HouseCall | TROJ_GEN.R002C0DBK25 |
| VBA32 | CIL.StupidPInvoker-1.Heur |
| VIPRE | Application.Generic.3107738 |
| Varist | W32/MSIL_Kryptik.GCW.gen!Eldorado |
| ViRobot | Trojan.Win.Z.Noon.643584 |
| VirIT | Trojan.Win32.MSIL_Heur.A |
| Webroot | W32.Malware.gen |
| Xcitium | Malware@#2vtnvnnse6ss2 |
| Yandex | Trojan.Igent.bWZO3p.83 |
| Zillya | Trojan.Noon.Win32.22028 |
| huorong | HEUR:VirTool/MSIL.Obfuscator.gen!E |
| tehtris | Generic.Malware |
| Cyren | W32/MSIL_Kryptik.GCW.gen!Eldorado |
| Symantec | Scr.Malcode!gdn30 |
| Cynet | Malicious (score: 100) |
| Kaspersky | UDS:Trojan-PSW.MSIL.Stealer.gen |
| McAfee-GW-Edition | BehavesLike.Win32.Fareit.jc |
| Kingsoft | Win32.PSWTroj.Undef.(kcloud) |
| Microsoft | Trojan:Win32/AgentTesla!ml |
| Yandex | Trojan.Slntscn24.bWfT6q |
| Fortinet | MSIL/CoinMiner.YII!tr |
| BitDefenderTheta | Gen:NN.ZemsilF.34266.Nm0@ayWOhPo |
| MaxSecure | Trojan.Malware.300983.susgen |
| MicroWorld-eScan | Trojan.GenericKD.38061465 |
| ALYac | Trojan.GenericKD.47434317 |
| K7AntiVirus | Trojan ( 004b8a551 ) |
| K7GW | Trojan ( 004b8a551 ) |
| BitDefenderTheta | Gen:NN.ZemsilF.34294.Nm0@ayWOhPo |
| TrendMicro-HouseCall | TROJ_FRS.VSNTKJ21 |
| BitDefender | Trojan.GenericKD.38061465 |
| Ad-Aware | Trojan.GenericKD.38061465 |
| Comodo | TrojWare.Win32.UMal.urdey@0 |
| F-Secure | Trojan.TR/Spy.Noon.mshfs |
| TrendMicro | TROJ_FRS.VSNTKJ21 |
| Emsisoft | Trojan.GenericKD.38061465 (B) |
| GData | Trojan.GenericKD.38061465 |
| Avira | TR/Spy.Noon.mshfs |
| Gridinsoft | Ransom.Win32.Gen.sa |
| Arcabit | Trojan.Generic.D244C599 |
| MAX | malware (ai score=99) |
| Malwarebytes | Trojan.MalPack.PNG.Generic |
| Webroot | W32.Trojan.Gen |
| CrowdStrike | win/malicious_confidence_90% (W) |
| Malwarebytes | Malware.AI.1669512993 |
| Rising | Malware.Obfus/[email protected] (RDM.MSIL2:KzWqi2TWqoxuLQfy8KYRoA) |
| alibabacloud | Trojan[spy]:MSIL/AgentTesla.SZ8PHU |