Purchase Order.exe

Classification: Malicious

Purchase Order.exe is a trojan (application/x-dosexec). Detected by 30 antivirus engines. Linked to Turla activity.

Detection summary

  • 30 antivirus detections
  • 0 IDS alerts
  • 0 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Intrusion sets: TURLA (G0010)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Snake ThreatFox Abuse.ch 2025-02-20 09:39:28 2025-02-22 09:32:28 G0010 Turla
SnakeKeylogger Abuse.ch 2021-12-08 06:37:04 2021-12-08 06:37:04 malicious-activity

Tags

win.snake ekans snakehose

Sample information

Filenames
Purchase Order.exe
File type
application/x-dosexec
MD5
9c31f5e68471743116a36daafdcb4786
SHA-1
1298ebc4f06c319b05a2b448eaf4931737203d64
SHA-256
17e9ee6953eec4fa0a69b8c11e02d4656e41338697a435e58e0fd8bfa1f00183
First indexed
2021-12-08 08:15:13
Last updated
2026-09-11 02:24:40

Antivirus detections

EngineDetection
MicroWorld-eScanTrojan.GenericKD.38223291
FireEyeTrojan.GenericKD.38223291
BitDefenderTrojan.GenericKD.38223291
SymantecMSIL.Packed.19
ESET-NOD32a variant of MSIL/GenKryptik.FOOK
APEXMalicious
Paloaltogeneric.ml
KasperskyHEUR:Trojan-PSW.MSIL.Stealer.gen
AlibabaTrojan:Win32/runner.ali1000123
Ad-AwareTrojan.GenericKD.38223291
DrWebTrojan.Siggen16.1584
TrendMicroTrojanSpy.MSIL.NEGASTEAL.SMG
McAfee-GW-EditionArtemis!Trojan
EmsisoftTrojan.Agent (A)
SentinelOneStatic AI - Suspicious PE
KingsoftWin32.PSWTroj.Undef.(kcloud)
MicrosoftTrojan:MSIL/AgentTesla.DQY!MTB
GDataMSIL.Trojan-Spy.Snake.27CWBZ
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win.Infostealer.R456991
McAfeeArtemis!9C31F5E68471
MAXmalware (ai score=86)
MalwarebytesTrojan.MalPack.ADC
PandaTrj/GdSda.A
TrendMicro-HouseCallTrojanSpy.MSIL.NEGASTEAL.SMG
IkarusTrojan.Inject
FortinetMSIL/GenKryptik.FOOK!tr
AVGWin32:SpywareX-gen [Trj]
AvastWin32:SpywareX-gen [Trj]
MaxSecureTrojan.Malware.300983.susgen