MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a85d9594291961d037a8aa9d4ce5529a4bdd7be97d299b984696ba36961473fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TurtleLoader


Vendor detections: 17


Intelligence 17 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a85d9594291961d037a8aa9d4ce5529a4bdd7be97d299b984696ba36961473fe
SHA3-384 hash: c75b43de7368921a560d7845e1bc44b366219c600a60f2b18ed86781bc3836e6d1c4eaa36bb598d1e8b5b300eaaab3db
SHA1 hash: 3f65fe83c3c61aa10326f2c170f2484502cc2645
MD5 hash: 8579ba3677900ab99b68f486f7fa4a7a
humanhash: lake-sixteen-georgia-georgia
File name:BypassAV.exe
Download: download sample
Signature TurtleLoader
Create hunting rule
File size:107'520 bytes
First seen:2025-12-26 05:03:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e412052f152faef9c4a9df0c285ac768 (1 x TurtleLoader)
ssdeep 192:OZ9aZ5xeQYl8WyIQg5YWMp3Q5tf4chJEmGhauRY9SRXiKqiRsYuRY9SRXiKqiRsW:nZPjq80Yjp3wJ8w99Sjvb99Sjvh
TLSH T156B32F539AEC3CCBC038A3B077BB93D4D72EDD99A0A2C11E96D01295D8BD41779227D8
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon f0968ee8aae8e8b2 (10 x ValleyRAT, 9 x Urelas, 5 x HermeticWiper)
Reporter Ling
Tags:exe Trojan:Win64/TurtleLoader!rfn TurtleLoader


Avatar
CNGaoLing
Trojan:Win64/TurtleLoader!rfn

Intelligence

File Origin
# of uploads :
1
# of downloads :
115
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
cobaltstrike
Create hunting rule
ID:
1
File name:
a85d9594291961d037a8aa9d4ce5529a4bdd7be97d299b984696ba36961473fe.exe
Verdict:
Malicious activity
Analysis date:
2025-12-26 00:26:01 UTC
Tags:
cobaltstrike
Link:
https://app.any.run/tasks/aa99a270-9fb0-456c-a589-1133fc3593a5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CobaltStrikeStager
Create hunting rule
Link:
https://www.capesandbox.com/analysis/46142/
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=694dd61801c7b4a8fe55e82d
Tags:
cobaltstrike cobalt
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm base64 meterpreter microsoft_visual_cc rozena
Link:
https://www.filescan.io/uploads/694e174de126b9ff4391c85c/reports/7a9cf5e5-08e9-4c5b-aad3-499e36738219/overview
Verdict:
Malicious
Labled as:
Dump:Generic.ShellCode.Marte.2
Link:
https://www.hybrid-analysis.com/sample/a85d9594291961d037a8aa9d4ce5529a4bdd7be97d299b984696ba36961473fe
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-12-25T14:53:00Z UTC
Last seen:
2025-12-27T06:38:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan.Win32.Generic Trojan.Win64.Shlem.sb Trojan.Win64.Shelm.sb Trojan.Win32.Shelm.a HEUR:Trojan.Win64.Shelma.a
Link:
https://opentip.kaspersky.com/a85d9594291961d037a8aa9d4ce5529a4bdd7be97d299b984696ba36961473fe/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/9b9f2016-470d-4a32-b1a6-c363d51e6149
Score:
69%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/a85d9594291961d037a8aa9d4ce5529a4bdd7be97d299b984696ba36961473fe
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/8579ba3677900ab99b68f486f7fa4a7a
Detection:
cobaltstrike
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a85d9594291961d037a8aa9d4ce5529a4bdd7be97d299b984696ba36961473fe/
Verdict:
Malicious
Threat:
Family.COBALTSTRIKE
Link:
https://tip.neiki.dev/file/a85d9594291961d037a8aa9d4ce5529a4bdd7be97d299b984696ba36961473fe
Threat name:
Win64.Trojan.TurtleLoader
Create hunting rule
Status:
Malicious
First seen:
2025-12-26 00:26:01 UTC
File Type:
PE+ (Exe)
Extracted files:
33
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vbozlfbjdfq5an5ivkouzzkstjf5267jpuuzxgcgs25dnfquop7a._file
Verdict:
malicious
Label(s):
metasploit
Create hunting rule
Similar samples:
error
TurtleLoader
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike backdoor trojan
Link:
https://tria.ge/reports/251226-fqc9rszqfn/
Behaviour
Cobaltstrike
Cobaltstrike family
Malware Config
C2 Extraction:
http://192.168.139.137:6868/2zmD
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/765d482a-5ed8-47d5-93e9-2f2aa8c8e192
Unpacked files
SH256 hash:
a85d9594291961d037a8aa9d4ce5529a4bdd7be97d299b984696ba36961473fe
MD5 hash:
8579ba3677900ab99b68f486f7fa4a7a
SHA1 hash:
3f65fe83c3c61aa10326f2c170f2484502cc2645
Link:
https://www.unpac.me/results/01bc8ca5-8d3f-4178-b6fb-cf288608a439/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a85d9594291961d037a8aa9d4ce5529a4bdd7be97d299b984696ba36961473fe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CAS_Malware_Hunting
Create hunting rule
Author:Michael Reinprecht
Description:DEMO CAS YARA Rules for sample2.exe
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TurtleLoader

Executable exe a85d9594291961d037a8aa9d4ce5529a4bdd7be97d299b984696ba36961473fe

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/46142/

Comments