RFQABCO004806L____________________pdf.exe

Classification: Malicious

RFQABCO004806L____________________pdf.exe is a trojan (Windows executable, 385.0 KB). Detected by 66 antivirus engines. Linked to Turla activity.

Detection summary

  • 66 antivirus detections
  • 1 IDS alerts
  • 1 processes observed
  • 1 contacted hosts
  • 1 DNS requests

MITRE ATT&CK associations

Intrusion sets: TURLA (G0010)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Snake ThreatFox Abuse.ch 2025-02-20 09:40:43 2025-02-22 09:25:38 G0010 Turla
Generic Malware Hybrid-Analysis 2024-11-05 14:15:05 2024-11-05 14:45:10
SnakeKeylogger MalwareBazaar Abuse.ch 2024-11-05 13:53:40 2024-11-05 13:53:40 malicious-activity

Tags

malicious win.snake ekans snakehose

Sample information

Filenames
RFQABCO004806L____________________pdf.exe
File type
PE32 executable (GUI) Intel 80386 Mono/.Net assemb ...
Size
394240 bytes
MD5
07c2f058cd20ca2ea748897dfe3ae4be
SHA-1
9eed7f03355832fdf0e121d5528a1217844688a4
SHA-256
2387dfcd993c8035b2f72ad89935d4521b294010115384aaa9cf93813f7ae4ce
First indexed
2024-11-05 13:53:31
Last updated
2026-09-22 23:13:05

Antivirus detections

EngineDetection
ALYacGen:Variant.Jalapeno.18778
APEXMalicious
AVGWin32:DropperX-gen [Drp]
AhnLab-V3Trojan/Win.Generic.C5690826
AlibabaTrojanSpy:MSIL/SnakeLogger.395811ae
ArcabitTrojan.Jalapeno.D495A
AvastWin32:DropperX-gen [Drp]
AviraTR/Dldr.Agent.dttai
BitDefenderGen:Variant.Jalapeno.18778
CAT-QuickHealTrojan.Ghanarava.17334365413ae4be
CTXexe.trojan.msil
CrowdStrikewin/malicious_confidence_100% (W)
CylanceUnsafe
DeepInstinctMALICIOUS
ESET-NOD32a variant of MSIL/TrojanDownloader.Agent.OXE
Elasticmalicious (high confidence)
EmsisoftGen:Variant.Jalapeno.18778 (B)
F-SecureTrojan.TR/Dldr.Agent.dttai
FireEyeGen:Variant.Jalapeno.18778
FortinetMSIL/Kryptik.AMPN!tr
GDataGen:Variant.Jalapeno.18778
GoogleDetected
IkarusTrojan-Downloader.MSIL.Agent
K7AntiVirusTrojan-Downloader ( 005a01891 )
K7GWTrojan-Downloader ( 005a01891 )
KasperskyHEUR:Trojan-Spy.MSIL.SnakeLogger.gen
Kingsoftmalware.kb.c.868
LionicTrojan.Win32.SnakeLogger.l!c
MalwarebytesTrojan.Downloader.MSIL
MaxSecureTrojan.Malware.184879108.susgen
McAfeeArtemis!07C2F058CD20
McAfeeDReal Protect-LS!07C2F058CD20
MicroWorld-eScanGen:Variant.Jalapeno.18778
MicrosoftTrojan:Win32/Znyonm
NANO-AntivirusTrojan.Win32.SnakeLogger.ktfuxl
Paloaltogeneric.ml
PandaTrj/Chgt.AD
RisingSpyware.SnakeLogger!8.15FDD (CLOUD)
SangforDownloader.Msil.Snakelogger.V22y
SentinelOneStatic AI - Malicious PE
SkyhighBehavesLike.Win32.Generic.fm
SophosMal/Generic-S
SymantecMSIL.Downloader!gen8
TencentMalware.Win32.Gencirc.1420267c
VBA32TScope.Trojan.MSIL
VIPREGen:Variant.Jalapeno.18778
VaristW32/ABTrojan.MSUW-7209
VirITTrojan.Win32.MSIL_Heur.A
XcitiumMalware@#9i3kqm4nzhea
YandexTrojan.Igent.b3ihM0.5
ZillyaDownloader.Agent.Win32.579791
ZonerTrojan.Win32.177928
huorongTrojanDownloader/MSIL.Agent.aeq
AVGDropperX-gen [Drp]
AlibabaTrojan:MSIL/Generic.b8ee478c
AvastDropperX-gen [Drp]
BkavW32.AIDetectMalware.CS
CrowdStrikewin/malicious_confidence_90% (D)
FireEyeGen:Variant.MSILHeracles.186840
GDataGen:Variant.MSILHeracles.186840
IkarusWin32.Outbreak
KasperskyUDS:Trojan-Spy.MSIL.SnakeLogger.gen
MicroWorld-eScanGen:Variant.MSILHeracles.186840
MicrosoftTrojan:Win32/Wacatac.B!ml
VBA32Downloader.MSIL.PureCrypter.Heur
ZoneAlarmUDS:Trojan-Spy.MSIL.SnakeLogger.gen

Network contacts

190.171.170.94

DNS requests

toyscenter.cl

Process list

NameCommand line
RFQABCO004806L____________________pdf.exe