TT Copy USD 70,781 (swift copy).Pdf.exe
Classification: Malicious
TT Copy USD 70,781 (swift copy).Pdf.exe is a trojan (application/x-dosexec). Detected by 59 antivirus engines. Linked to Turla activity.
Detection summary
- 59 antivirus detections
- 0 IDS alerts
- 0 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Intrusion sets: TURLA (G0010)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Snake | ThreatFox Abuse.ch | 2025-02-20 09:39:45 | 2025-02-22 09:30:54 | G0010 Turla | |
| Spyware | VM-Ray | 2022-11-04 18:29:10 | 2022-11-04 18:29:10 | ||
| Keylogger | VM-Ray | 2022-11-04 18:29:10 | 2022-11-04 18:29:10 | ||
| SnakeKeylogger | MalwareBazaar Abuse.ch | 2022-11-04 17:10:13 | 2022-11-04 17:10:13 |
Tags
win.snake ekans snakehoseSample information
- Filenames
- 1ab39b59bd987548de3ae8715b9270a1c55dbee9c8a3a73a6a6bf7317d4f7075.exe, TT Copy USD 70,781 (swift copy).Pdf.exe
- File type
- application/x-dosexec
- MD5
49e78bf4d711a36034e5d7b5153d2c25- SHA-1
7a81113be6bec8e66841446e98389d7b51ae9d43- SHA-256
1ab39b59bd987548de3ae8715b9270a1c55dbee9c8a3a73a6a6bf7317d4f7075- First indexed
- 2022-11-04 17:10:13
- Last updated
- 2026-10-06 23:01:47
Antivirus detections
| Engine | Detection |
|---|---|
| ALYac | Trojan.GenericKD.63554547 |
| APEX | Malicious |
| AVG | Win32:PWSX-gen [Trj] |
| AhnLab-V3 | Trojan/Win.MSILZilla.C5298912 |
| Alibaba | Trojan:Win32/starter.ali1000139 |
| Arcabit | Trojan.Generic.D3C9C3F3 |
| Avast | Win32:PWSX-gen [Trj] |
| Avira | HEUR/AGEN.1306804 |
| BitDefender | Trojan.GenericKD.63554547 |
| Bkav | W32.AIDetectMalware.CS |
| CAT-QuickHeal | Trojan.YakbeexMSIL.ZZ4 |
| CTX | exe.trojan.msil |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cylance | Unsafe |
| DeepInstinct | MALICIOUS |
| DrWeb | Trojan.Inject4.46282 |
| ESET-NOD32 | a variant of MSIL/Kryptik.AHAF |
| Elastic | malicious (high confidence) |
| Emsisoft | Trojan.GenericKD.63554547 (B) |
| F-Secure | Heuristic.HEUR/AGEN.1306804 |
| FireEye | Generic.mg.49e78bf4d711a360 |
| Fortinet | MSIL/Kryptik.AGZA!tr |
| GData | Trojan.GenericKD.63554547 |
| Detected | |
| Ikarus | Trojan-Spy.AgentTesla |
| Jiangmin | TrojanSpy.MSIL.cwcj |
| K7AntiVirus | Trojan ( 00599ddf1 ) |
| K7GW | Trojan ( 00599ddf1 ) |
| Kaspersky | HEUR:Trojan-Spy.MSIL.SnakeLogger.gen |
| Kingsoft | Win32.Troj.Generic.jm |
| Lionic | Trojan.Win32.SnakeLogger.l!c |
| Malwarebytes | Generic.Malware.AI.DDS |
| McAfee | GenericRXUQ-IM!49E78BF4D711 |
| McAfeeD | ti!1AB39B59BD98 |
| MicroWorld-eScan | Trojan.GenericKD.63554547 |
| Microsoft | Trojan:MSIL/FormBook.AFM!MTB |
| NANO-Antivirus | Trojan.Win32.SnakeLogger.jtgztx |
| Paloalto | generic.ml |
| Panda | Trj/GdSda.A |
| Rising | Malware.Obfus/[email protected] (RDM.MSIL2:ljiyWKZYljuComMksDvRXA) |
| Sangfor | Spyware.Msil.Kryptik.Vagh |
| SentinelOne | Static AI - Malicious PE |
| Skyhigh | BehavesLike.Win32.Generic.dc |
| Sophos | Troj/Krypt-SL |
| Symantec | Trojan Horse |
| Tencent | Msil.Trojan-Spy.Snakelogger.Vmhl |
| Trapmine | malicious.high.ml.score |
| TrendMicro-HouseCall | Trojan.Win32.VSX.PE04C9V |
| VBA32 | TScope.Trojan.MSIL |
| VIPRE | Trojan.GenericKD.63554547 |
| Varist | W32/MSIL_Kryptik.IIB.gen!Eldorado |
| VirIT | Trojan.Win32.MSIL_Heur.A |
| Webroot | W32.Trojan.Gen |
| Xcitium | Malware@#3u9rljhwzqmfe |
| Yandex | Trojan.Igent.bY1Ch5.1 |
| Zillya | Trojan.Kryptik.Win32.3962430 |
| ZoneAlarm | Troj/Krypt-SL |
| alibabacloud | Trojan[spy]:MSIL/FormBook.A#O2XJC |
| huorong | TrojanSpy/MSIL.AgentTesla.gt |