z56Contract.exe
Classification: Malicious
z56Contract.exe is a malicious file sample (application/x-dosexec, 493.0 KB). Linked to Turla activity. Reported by 4 threat sources, last seen 2025-05-13.
Detection summary
- 0 antivirus detections
- 1 IDS alerts
- 2 processes observed
- 1 contacted hosts
- 1 DNS requests
MITRE ATT&CK associations
Intrusion sets: TURLA (G0010)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Generic Malware | Hybrid-Analysis | 2025-05-13 14:00:12 | 2025-05-13 14:15:17 | ||
| Snake | ThreatFox Abuse.ch | 2025-02-20 09:40:51 | 2025-02-22 09:24:48 | G0010 Turla | |
| Spyware | VM-Ray | 2023-11-29 17:21:44 | 2023-11-29 19:22:44 | ||
| SnakeKeylogger | MalwareBazaar Abuse.ch | 2023-11-29 14:24:09 | 2023-11-29 14:24:09 | malicious-activity |
Tags
win.snake ekans snakehose stealer telegramrat windows-server-utilitySample information
- Filenames
- 24c6082628e6b6daeede59cf5c1f1174a3ab6b3ac7e0d795f8c7c3af490f1940, z56Contract.exe
- File type
- application/x-dosexec
- Size
- 504832 bytes
- MD5
528120e21119abe464179f5ab433a333- SHA-1
b80f5f12815584bddb246d36427c994629ba5c8e- SHA-256
24c6082628e6b6daeede59cf5c1f1174a3ab6b3ac7e0d795f8c7c3af490f1940- First indexed
- 2023-11-29 15:18:45
- Last updated
- 2026-09-29 07:25:55
Network contacts
DNS requests
Process list
| Name | Command line |
|---|---|
| 24c6082628e6b6daeede59cf5c1f1174a3ab6b3ac7e0d795f8c7c3af490f1940.exe | |
| 24c6082628e6b6daeede59cf5c1f1174a3ab6b3ac7e0d795f8c7c3af490f1940.exe | |