Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 20:05:09 UTC
Home > List all groups > List all tools > List all groups using tool EYService
 Tool: EYService
Names EYService
Category Malware
Type Backdoor
Description
(Epic Turla) The main functionality orchestrating the different subcomponents is contained
within Data.bin, later renamed to ‘svchost.exe’. The orchestrator takes 17 different three digit
codes to divert functionality within a giant switch statement. Some of the codes have not been
fully implemented up to the latest samples I’ve found so far, which further suggests a
continued developmental effort.
Information
Malpedia Last change to this tool card: 24 April 2021
Download this tool card in JSON format
All groups using tool EYService
Changed Name Country Observed
APT groups
 Nazar 2008
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=d1357aaf-4d8d-4164-a083-7c706e00fcbe
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=d1357aaf-4d8d-4164-a083-7c706e00fcbe
Page 1 of 1