595a54f0bbf297041ce259461ae8a12f37fb29e5180705eafb3668b4a491cecc.exe

Classification: Malicious

595a54f0bbf297041ce259461ae8a12f37fb29e5180705eafb3668b4a491cecc.exe is a malicious file sample. Linked to Turla, Oilrig activity.

Detection summary

  • 55 antivirus detections (72% detection ratio)
  • 0 IDS alerts
  • 1 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Intrusion sets: TURLA (G0010) OILRIG (G0049)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Cyber Threat Alliance 2026-08-11 10:27:04 2026-08-11 10:27:04 malicious-activity
Generic Malware Hybrid-Analysis 2023-04-26 08:15:02 2023-04-26 08:15:02
Turla Maltiverse 2023-03-03 04:26:37 2023-03-04 19:42:09 malicious-activity G0010 Turla
OilRig Maltiverse 2023-03-03 04:26:38 2023-03-04 19:41:53 malicious-activity G0049 OilRig

Tags

apt group88 hacktool hippoteam krypton metasploit meterpreter pfinet snake tag_0530 turla turlagroup turlateam uroburos venomousbear waterbug wraith apt34

Sample information

Filenames
595a54f0bbf297041ce259461ae8a12f37fb29e5180705eafb3668b4a491cecc.exe
File type
PE32+ executable (GUI) x86-64, for MS Windows
Size
156672 bytes
MD5
5a65fc8d425925e26115c7337664b13e
SHA-1
5f29378ae5967dcf0a2c62f3613b3c1939905bd4
SHA-256
595a54f0bbf297041ce259461ae8a12f37fb29e5180705eafb3668b4a491cecc
First indexed
2023-03-04 19:41:53
Last updated
2025-10-11 17:47:36

Antivirus detections

EngineDetection
ALYacBackdoor.Turla.A
AVGWin64:Trojan-gen
AlibabaTrojan:Win64/Turla.7ce0ec16
Antiy-AVLTrojan[APT]/Win32.Turla
ArcabitTrojan.Agent.DYXU
AvastWin64:Trojan-gen
AviraTR/Agent.yqclj
BitDefenderTrojan.Agent.DYXU
BkavW32.Common.9BC8B510
CAT-QuickHealTrojan.Ghanarava.171416323564b13e
CTXexe.trojan.turla
CrowdStrikewin/malicious_confidence_100% (W)
CylanceUnsafe
CynetMalicious (score: 99)
DeepInstinctMALICIOUS
DrWebTrojan.BtcMine.3425
ESET-NOD32Win64/Agent.OV
Elasticmalicious (moderate confidence)
EmsisoftTrojan.Agent.DYXU (B)
F-SecureTrojan.TR/Agent.yqclj
FortinetW64/Agent.OV!tr
GDataTrojan.Agent.DYXU
GoogleDetected
IkarusTrojan.Win64.Agent
JiangminTrojan.Turla.ah
K7AntiVirusTrojan ( 0055096c1 )
K7GWTrojan ( 0055096c1 )
KasperskyTrojan.Win32.Turla.ec
Kingsoftmalware.kb.a.763
LionicTrojan.Win32.Turla.4!c
MalwarebytesMalware.AI.4174668183
MaxSecureTrojan.Malware.74404054.susgen
McAfeeDti!595A54F0BBF2
MicroWorld-eScanTrojan.Agent.DYXU
MicrosoftTrojan:Win64/Corserm.B
NANO-AntivirusTrojan.Win64.Turla.fwskto
Paloaltogeneric.ml
PandaTrj/CI.A
RisingTrojan.Agent!8.B1E (CLOUD)
SangforBackdoor.Win32.Turla.ulxpg
SkyhighGeneric trojan.py
SophosMal/Generic-S
SymantecML.Attribute.HighConfidence
TencentMalware.Win32.Gencirc.1434a152
Trapminemalicious.moderate.ml.score
TrellixENSGeneric .py
TrendMicroTrojan.Win64.TURLA.AB
TrendMicro-HouseCallTrojan.Win64.TURLA.AB
VBA32Trojan.Turla
VIPRETrojan.Agent.DYXU
VaristW64/Agent.NBAW
XcitiumMalware@#wz13f3b3a082
ZillyaTrojan.Turla.Win32.144
ZoneAlarmTroj/Agent-BBVT
alibabacloudTrojan:Win/Corserm.B

Process list

NameCommand line
595a54f0bbf297041ce259461ae8a12f37fb29e5180705eafb3668b4a491cecc.exe