Classification: Malicious
fddb5.Trojan.exe is a trojan (application/x-dosexec, 21.0 KB). Flagged by 48% of antivirus engines (35 detections). Linked to Turla activity.
Detection summary
- 35 antivirus detections (48% detection ratio)
- 1 IDS alerts
- 3 processes observed
- 1 contacted hosts
- 1 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| Snake |
ThreatFox Abuse.ch |
2025-02-20 09:36:43 |
2025-02-22 09:47:32 |
|
G0010 Turla
|
| Generic Malware |
Hybrid-Analysis |
2023-11-03 21:00:03 |
2023-11-03 22:30:12 |
|
|
| Spyware |
VM-Ray |
2023-11-03 18:22:58 |
2023-11-03 19:23:37 |
|
|
| Backdoor |
VM-Ray |
2023-11-03 18:22:58 |
2023-11-03 19:23:37 |
|
|
| SnakeKeylogger |
MalwareBazaar Abuse.ch |
2023-11-03 16:17:05 |
2023-11-03 16:17:05 |
malicious-activity
|
|
Tags
win.snake
ekans
snakehose
Sample information
- Filenames
- fddb5.Trojan.exe, fddb5c07d9ae4295bec096fe40d29b14c27be92760e586ec99ca43a43fe16244.exe, VakifBankKrediKartiHesapOzeti.exe
- File type
- application/x-dosexec
- Size
- 21504 bytes
- MD5
7c680b856965144ada69a5afcb031813- SHA-1
01967f1e2da8cdf027d42f4fa6f8d2214c7e0a49- SHA-256
fddb5c07d9ae4295bec096fe40d29b14c27be92760e586ec99ca43a43fe16244- First indexed
- 2023-11-03 17:18:47
- Last updated
- 2026-09-17 00:59:17
Antivirus detections
| Engine | Detection |
|---|
| Elastic | malicious (high confidence) |
| MicroWorld-eScan | Gen:Variant.Marsilia.82458 |
| Malwarebytes | Spyware.SnakeKeylogger |
| VIPRE | Gen:Variant.Marsilia.82458 |
| BitDefender | Gen:Variant.Marsilia.82458 |
| Arcabit | Trojan.Marsilia.D1421A |
| Symantec | ML.Attribute.HighConfidence |
| ESET-NOD32 | a variant of MSIL/TrojanDownloader.Agent.PVO |
| APEX | Malicious |
| Kaspersky | HEUR:Trojan-Downloader.MSIL.Seraph.gen |
| Alibaba | TrojanDownloader:MSIL/Seraph.77725af1 |
| F-Secure | Trojan.TR/AD.Nekark.eddsf |
| FireEye | Gen:Variant.Marsilia.82458 |
| Emsisoft | Gen:Variant.Marsilia.82458 (B) |
| SentinelOne | Static AI - Suspicious PE |
| MAX | malware (ai score=80) |
| Webroot | W32.Malware.Gen |
| Google | Detected |
| Avira | TR/AD.Nekark.eddsf |
| Kingsoft | malware.kb.c.964 |
| Microsoft | Trojan:Win32/Leonem |
| ZoneAlarm | HEUR:Trojan-Downloader.MSIL.Seraph.gen |
| GData | Gen:Variant.Marsilia.82458 |
| Cynet | Malicious (score: 100) |
| AhnLab-V3 | Trojan/Win.Generic.C5536939 |
| DeepInstinct | MALICIOUS |
| TrendMicro-HouseCall | TROJ_GEN.R06CH0DK123 |
| Tencent | Msil.Trojan-Downloader.Ader.Agow |
| Yandex | Trojan.Igent.b08g3g.10 |
| Ikarus | PUA.Optional.Install |
| MaxSecure | Trojan.Malware.300983.susgen |
| Fortinet | Adware/Agent |
| AVG | Win64:KeyloggerX-gen [Trj] |
| Avast | Win64:KeyloggerX-gen [Trj] |
| CrowdStrike | win/malicious_confidence_70% (W) |
Process list
| Name | Command line |
|---|
| fddb5.Trojan.exe | |
| WerFault.exe | -u -p 8760 -s 2292 |
| WerFault.exe | -u -p 8760 -s 2292 |