PO.exe

Classification: Malicious

PO.exe is a trojan (application/x-dosexec). Detected by 80 antivirus engines. Linked to Turla activity. Reported by 2 threat sources, last seen 2025-02-22.

Detection summary

  • 80 antivirus detections
  • 0 IDS alerts
  • 0 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Intrusion sets: TURLA (G0010)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Snake ThreatFox Abuse.ch 2025-02-20 09:39:26 2025-02-22 09:32:42 G0010 Turla
SnakeKeylogger Abuse.ch 2021-12-08 15:32:53 2021-12-08 15:32:53 malicious-activity

Tags

win.snake ekans snakehose

Sample information

Filenames
PO.exe
File type
application/x-dosexec
MD5
3d56aa92e3140439afcbe7f1a872d1de
SHA-1
80a174d06fddd2f42841ca7779b66f85411a7db6
SHA-256
17b8c7fc55ceb4945106a143ceb827d3c6a7525afd864172f968f3f7a1eb77ff
First indexed
2021-12-08 17:15:15
Last updated
2026-09-11 02:24:30

Antivirus detections

EngineDetection
ALYacGen:Variant.MSILHeracles.NotFoundKeylogger.18337
APEXMalicious
AVGWin32:PWSX-gen [Trj]
AhnLab-V3Trojan/Win.SnakeKeylogger.R433068
AlibabaTrojanPSW:MSIL/Mintluks.0f4af6de
Antiy-AVLGrayWare/MSIL.Agent.aes
ArcabitTrojan.MSILHeracles.NotFoundKeylogger.D47A1
AvastWin32:PWSX-gen [Trj]
AviraTR/ATRAPS.Gen
BitDefenderGen:Variant.MSILHeracles.NotFoundKeylogger.18337
BkavW32.AIDetectMalware.CS
CAT-QuickHealTrojan.YakbeexMSIL.ZZ4
CTXexe.trojan.msil
ClamAVWin.Dropper.Snake-9953538-0
CrowdStrikewin/malicious_confidence_100% (W)
CylanceUnsafe
DeepInstinctMALICIOUS
DrWebTrojan.KeyloggerNET.54
ESET-NOD32a variant of MSIL/Spy.Agent.AES
ElasticWindows.Trojan.SnakeKeylogger
EmsisoftTrojan-Spy.Agent (A)
F-SecureTrojan.TR/ATRAPS.Gen
FireEyeGeneric.mg.3d56aa92e3140439
FortinetMSIL/SnakeKeylogger!tr.spy
GDataMSIL.Trojan-Spy.SnakeKeylogger.D
GoogleDetected
GridinsoftTrojan.Win32.Agent.dd!n
IkarusTrojan-Spy.Echelon
JiangminTrojan.PSW.MSIL.cmfr
K7GWTrojan ( aaa0070a1 )
KasperskyHEUR:Trojan.Win32.Generic
Kingsoftmalware.kb.c.995
LionicTrojan.Win32.Generic.4!c
MalwarebytesKeyLogger.Spyware.Stealer.DDS
MaxSecureTrojan.W32.Generic
McAfeePWS-FDDX!3D56AA92E314
McAfeeDReal Protect-LS!3D56AA92E314
MicroWorld-eScanGen:Variant.MSILHeracles.NotFoundKeylogger.18337
MicrosoftPWS:MSIL/Mintluks!atmn
Paloaltogeneric.ml
PandaTrj/GdSda.A
RisingSpyware.Snake!1.D9B7 (CLASSIC)
SangforTrojan.Win32.Save.a
SentinelOneStatic AI - Malicious PE
SkyhighBehavesLike.Win32.Generic.cm
SophosMal/Stealer-P
SymantecML.Attribute.HighConfidence
TencentTrojan-Spy.Msil.Agent.zbk
VBA32Malware-Cryptor.MSIL.AgentTesla.Heur
VIPREGen:Variant.MSILHeracles.NotFoundKeylogger.18337
VaristW32/MSIL_Kryptik.FAU.gen!Eldorado
VirITTrojan.Win32.MSIL_Heur.A
WebrootW32.Trojan.Gen
XcitiumMalware@#byttd8l2nfh0
YandexTrojan.Igent.bW5cYT.8
ZillyaTrojan.Agent.Win32.4032266
huorongTrojanSpy/MSIL.PwStealer.ch
Elasticmalicious (high confidence)
MicroWorld-eScanIL:Trojan.MSILZilla.5788
K7AntiVirusTrojan ( 700000121 )
AlibabaTrojanPSW:MSIL/Mintluks.ce47b455
CrowdStrikewin/malicious_confidence_90% (W)
CyrenW32/MSIL_Kryptik.FAU.gen!Eldorado
ClamAVWin.Packed.Passwordstealera-9900629-0
BitDefenderIL:Trojan.MSILZilla.5788
Ad-AwareIL:Trojan.MSILZilla.5788
DrWebBackDoor.RatNET.2
McAfee-GW-EditionPWS-FDDX!3D56AA92E314
SophosML/PE-A
IkarusTrojan.MSIL.Spy
GDataMSIL.Trojan-Stealer.SnakeKeylogger.A
eGambitUnsafe.AI_Score_100%
MicrosoftPWS:MSIL/Mintluks.A
CynetMalicious (score: 100)
BitDefenderThetaGen:NN.ZemsilF.34062.hm0@auaxG6o
ALYacIL:Trojan.MSILZilla.5788
MAXmalware (ai score=83)
MalwarebytesSpyware.SnakeKeylogger
FortinetMSIL/Agent.AES!tr
Cybereasonmalicious.2e3140