hareketleriniz pdf.exe
Classification: Malicious
hareketleriniz pdf.exe is a trojan (Windows executable). Detected by 61 antivirus engines. Linked to Darkcomet malware.
Detection summary
- 61 antivirus detections
- 0 IDS alerts
- 0 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Malware families: DARKCOMET (S0334)
Intrusion sets: TURLA (G0010)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Snake | ThreatFox Abuse.ch | 2025-02-20 09:39:05 | 2025-02-22 09:34:35 | G0010 Turla | |
| Spyware | VM-Ray | 2023-04-28 06:21:18 | 2023-04-28 06:21:18 | ||
| DarkComet | MalwareBazaar Abuse.ch | 2023-04-28 04:29:50 | 2023-04-28 04:29:50 | malicious-activity | S0334 DarkComet |
Tags
win.snake ekans snakehoseSample information
- Filenames
- hareketleriniz pdf.exe, 149c80ebeeead2dff7b45f8a627d5396b995f6afc82f18487d7c6eb4bf071205.exe
- File type
- PE32 executable (GUI) Intel 80386, for MS Windows
- MD5
5e90d591b55d2b8479bc4de27178f082- SHA-1
6a07c7d735d57852f0876bfaf133f570b0975424- SHA-256
149c80ebeeead2dff7b45f8a627d5396b995f6afc82f18487d7c6eb4bf071205- First indexed
- 2023-04-28 04:45:30
- Last updated
- 2026-09-16 09:57:44
Antivirus detections
| Engine | Detection |
|---|---|
| ALYac | Trojan.Ransom.Loki.AUK |
| APEX | Malicious |
| AVG | Win32:PWSX-gen [Trj] |
| AhnLab-V3 | Trojan/Win.FormBook.R575808 |
| Alibaba | TrojanSpy:MSIL/GenKryptik.7085aac6 |
| Antiy-AVL | GrayWare/MSIL.Kryptik.arr |
| Arcabit | Trojan.Ransom.Loki.AUK |
| Avast | Win32:PWSX-gen [Trj] |
| Avira | HEUR/AGEN.1365588 |
| BitDefender | Trojan.Ransom.Loki.AUK |
| Bkav | W32.AIDetectMalware.CS |
| CAT-QuickHeal | Trojan.Ghanarava.168872768178f082 |
| CTX | exe.trojan.msil |
| ClamAV | Win.Dropper.Formbook-10023271-0 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cylance | Unsafe |
| DeepInstinct | MALICIOUS |
| DrWeb | Trojan.Packed2.45221 |
| ESET-NOD32 | a variant of MSIL/GenKryptik.GJGM |
| Elastic | malicious (high confidence) |
| Emsisoft | Trojan.Ransom.Loki.AUK (B) |
| F-Secure | Heuristic.HEUR/AGEN.1365588 |
| FireEye | Generic.mg.5e90d591b55d2b84 |
| Fortinet | MSIL/Kryptik.AIRX!tr |
| GData | Trojan.Ransom.Loki.AUK |
| Detected | |
| Ikarus | Trojan.MSIL.Inject |
| K7AntiVirus | Trojan ( 005a46191 ) |
| K7GW | Trojan ( 005a46191 ) |
| Kaspersky | HEUR:Trojan-Spy.MSIL.Noon.gen |
| Kingsoft | MSIL.Trojan.Taskun.gen |
| Lionic | Trojan.Win32.Loki.l!c |
| Malwarebytes | Crypt.Trojan.MSIL.DDS |
| MaxSecure | Trojan.Malware.73691310.susgen |
| McAfee | PWS-FDBP!5E90D591B55D |
| McAfeeD | ti!149C80EBEEEA |
| MicroWorld-eScan | Trojan.Ransom.Loki.AUK |
| Microsoft | Trojan:MSIL/FormBook.ABUA!MTB |
| NANO-Antivirus | Trojan.Win32.Noon.jwbuhf |
| Paloalto | generic.ml |
| Panda | Trj/Chgt.AD |
| Rising | Malware.Obfus/[email protected] (RDM.MSIL2:F4/cw8rIaax1Hr+3Ev+BlA) |
| Sangfor | Suspicious.Win32.Save.a |
| SentinelOne | Static AI - Malicious PE |
| Skyhigh | BehavesLike.Win32.Generic.tc |
| Sophos | Troj/Krypt-XL |
| Symantec | Scr.Malcode!gdn34 |
| Tencent | Malware.Win32.Gencirc.13bf2ef2 |
| Trapmine | suspicious.low.ml.score |
| TrendMicro | TROJ_GEN.R002C0DB425 |
| TrendMicro-HouseCall | TROJ_GEN.R002C0DB425 |
| VBA32 | TScope.Trojan.MSIL |
| VIPRE | Trojan.Ransom.Loki.AUK |
| Varist | W32/MSIL_Kryptik.KPV.gen!Eldorado |
| ViRobot | Trojan.Win.Z.Genkryptik.1427968 |
| VirIT | Trojan.Win32.MSIL_Heur.A |
| Webroot | W32.Infostealer.Formbook |
| Xcitium | Malware@#30b8yxpvucqet |
| Yandex | Trojan.Igent.bZ4S64.1 |
| Zillya | Trojan.Noon.Win32.27833 |
| huorong | TrojanSpy/MSIL.AgentTesla.kt |