19ee645f892375a3de23462f42581ccc7968e31d8bcd064bb481188ccc236458
Classification: Malicious
19ee645f892375a3de23462f42581ccc7968e31d8bcd064bb481188ccc236458 is a trojan (Windows executable). Detected by 58 antivirus engines. Linked to Turla activity.
Detection summary
- 58 antivirus detections
- 0 IDS alerts
- 0 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Intrusion sets: TURLA (G0010)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Snake | ThreatFox Abuse.ch | 2025-02-20 09:39:40 | 2025-02-22 09:31:24 | G0010 Turla | |
| Spyware | VM-Ray | 2022-08-09 02:20:29 | 2022-08-09 02:20:29 | ||
| Keylogger | VM-Ray | 2022-08-09 02:20:29 | 2022-08-09 02:20:29 | ||
| Injector | VM-Ray | 2022-08-09 02:20:29 | 2022-08-09 02:20:29 |
Tags
win.snake ekans snakehoseSample information
- Filenames
- 19ee645f892375a3de23462f42581ccc7968e31d8bcd064bb481188ccc236458.exe
- File type
- PE32 executable (GUI) Intel 80386, for MS Windows
- SHA-256
19ee645f892375a3de23462f42581ccc7968e31d8bcd064bb481188ccc236458- First indexed
- 2022-08-09 00:30:34
- Last updated
- 2026-09-24 11:56:17
Antivirus detections
| Engine | Detection |
|---|---|
| ALYac | Trojan.Keylogger.Snake |
| APEX | Malicious |
| AVG | Win32:PWSX-gen [Trj] |
| AhnLab-V3 | Trojan/Win.PWSX-gen.C5220789 |
| Alibaba | TrojanSpy:MSIL/AgentTesla.aa358bf1 |
| Antiy-AVL | Trojan/MSIL.Taskun |
| Arcabit | Generic.Dacic.62130D99.A.06428954 |
| Avast | Win32:PWSX-gen [Trj] |
| Avira | HEUR/AGEN.1306278 |
| BitDefender | Generic.Dacic.62130D99.A.06428954 |
| Bkav | W32.AIDetectMalware.CS |
| CAT-QuickHeal | Trojan.YakbeexMSIL.ZZ4 |
| CTX | exe.trojan.msil |
| ClamAV | Win.Packed.NetWire-10024015-0 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cylance | Unsafe |
| DeepInstinct | MALICIOUS |
| DrWeb | Trojan.Siggen18.33644 |
| ESET-NOD32 | MSIL/Spy.Agent.AES |
| Elastic | malicious (high confidence) |
| Emsisoft | Generic.Dacic.62130D99.A.06428954 (B) |
| F-Secure | Heuristic.HEUR/AGEN.1306278 |
| FireEye | Generic.mg.5a23d08136f5b28c |
| Fortinet | MSIL/Kryptik.DZG!tr |
| GData | Generic.Dacic.62130D99.A.06428954 |
| Detected | |
| Ikarus | Trojan.MSIL.Inject |
| K7AntiVirus | Trojan ( 00596bd21 ) |
| K7GW | Trojan ( 00596bd21 ) |
| Kaspersky | HEUR:Trojan-Spy.MSIL.Noon.gen |
| Kingsoft | malware.kb.c.705 |
| Lionic | Trojan.Win32.AgentTesla.l!c |
| Malwarebytes | Generic.Malware.AI.DDS |
| MaxSecure | Trojan.Malware.73691310.susgen |
| McAfee | GenericRXTX-HW!5A23D08136F5 |
| McAfeeD | ti!19EE645F8923 |
| MicroWorld-eScan | Generic.Dacic.62130D99.A.06428954 |
| Microsoft | Trojan:MSIL/AgentTesla.XB!MTB |
| Paloalto | generic.ml |
| Panda | Trj/GdSda.A |
| Rising | Malware.Obfus/[email protected] (RDM.MSIL2:a7lJP1Csaoz3VhV8yAphrQ) |
| Sangfor | Suspicious.Win32.Save.a |
| SentinelOne | Static AI - Malicious PE |
| Skyhigh | BehavesLike.Win32.Generic.bc |
| Sophos | Troj/Krypt-OW |
| Symantec | Scr.Malcode!gdn30 |
| Tencent | Malware.Win32.Gencirc.13ba0114 |
| Trapmine | suspicious.low.ml.score |
| VBA32 | Malware-Cryptor.MSIL.AgentTesla.Heur |
| VIPRE | Generic.Dacic.62130D99.A.06428954 |
| Varist | W32/MSIL_Kryptik.HVD.gen!Eldorado |
| VirIT | Trojan.Win32.MSIL_Heur.A |
| Xcitium | Malware@#nvg5ekx5sg3a |
| Yandex | Trojan.Igent.bYvoNI.1 |
| Zillya | Trojan.Agent.Win32.2918747 |
| Zoner | Trojan.Win32.143867 |
| huorong | TrojanSpy/MSIL.AgentTesla.fd |
| tehtris | Generic.Malware |