{ "id": "bbbb7807-d433-44ee-816e-a3d6c8e133ff", "created_at": "2026-04-10T03:21:41.185288Z", "updated_at": "2026-04-10T03:22:18.372789Z", "deleted_at": null, "sha1_hash": "66174a105244f393279b85f4cfd094691bda5270", "title": "malware-ioc/turla at master · eset/malware-ioc", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 62458, "plain_text": "malware-ioc/turla at master · eset/malware-ioc\r\nBy mFaou\r\nArchived: 2026-04-10 02:36:13 UTC\r\n35f205367e2e5f8a121925bbae6ff07626b526a7\r\nGazer loader x32\r\n05/02/2002 17:36:10\r\nadmin@solidloop.org valid from 14/10/2015 to 14/10/2016\r\nWin32/Turla.CC\r\nb151cd7c4f9e53a8dcbdeb7ce61ccdd146eb68ab\r\nGazer loader x32\r\n05/02/2002 17:36:10\r\nadmin@solidloop.org valid from 14/10/2015 to 14/10/2016\r\nWin32/Turla.CC\r\ne40bb5beec5678537e8fe537f872b2ad6b77e08a\r\nGazer loader x32\r\n05/02/2002 17:36:10\r\nadmin@solidloop.org valid from 14/10/2015 to 14/10/2016\r\nWin32/Turla.CC\r\n522e5f02c06ad215c9d0c23c5a6a523d34ae4e91\r\nGazer loader x64\r\n05/02/2002 17:36:26\r\nadmin@solidloop.org valid from 14/10/2015 to 14/10/2016\r\nWin64/Turla.AA\r\nc380038a57ffb8c064851b898f630312fabcbba7\r\nGazer loader x64\r\nhttps://github.com/eset/malware-ioc/tree/master/turla\r\nPage 1 of 10\n\n05/02/2002 17:36:26\r\nadmin@solidloop.org valid from 14/10/2015 to 14/10/2016\r\nWin64/Turla.AA\r\n267f144d771b4e2832798485108decd505cb824a\r\nGazer loader x64\r\n05/02/2002 17:36:26\r\nadmin@solidloop.org valid from 14/10/2015 to 14/10/2016\r\nWin64/Turla.AA\r\n52f6d09cccdbc38d66c184521e7ccf6b28c4b4d9\r\nGazer loader x32\r\n04/10/2002 18:31:37\r\nadmin@solidloop.org valid from 14/10/2015 to 14/10/2016\r\nWin32/Turla.CC\r\n475c59744accb09724dae610763b7284646ab63f\r\nGazer loader x32\r\n04/10/2002 18:31:37\r\nadmin@solidloop.org valid from 14/10/2015 to 14/10/2016\r\nWin32/Turla.CC\r\n22542a3245d52b7bcdb3eaef5b8b2693f451f497\r\nGazer loader x32\r\n04/10/2002 18:31:37\r\nadmin@solidloop.org valid from 14/10/2015 to 14/10/2016\r\nWin32/Turla.CC\r\n2b9faa8b0fcadac710c7b2b93d492ff1028b5291\r\nGazer loader x64\r\n04/10/2002 18:34:18\r\nhttps://github.com/eset/malware-ioc/tree/master/turla\r\nPage 2 of 10\n\nadmin@solidloop.org valid from 14/10/2015 to 14/10/2016\r\nWin64/Turla.AA\r\ne05ab6978c17724b7c874f44f8a6cbfb1c56418d\r\nGazer loader x64\r\n04/10/2002 18:34:18\r\nadmin@solidloop.org valid from 14/10/2015 to 14/10/2016\r\nWin64/Turla.AA\r\n6dec3438d212b67356200bbac5ec7fa41c716d86\r\nGazer loader x64\r\n04/10/2002 18:34:18\r\nadmin@solidloop.org valid from 14/10/2015 to 14/10/2016\r\nWin64/Turla.AA\r\nb548863df838069455a76d2a63327434c02d0d9d\r\nGazer loader x64\r\n09/01/2016 19:30:10\r\nnot signed\r\nWin64/Turla.AA\r\nc3e6511377dfe85a34e19b33575870dda8884c3c\r\nGazer loader x64\r\n06/02/2016 19:29:15\r\nadmin@ultimatecomsup.biz valid from 16/12/2015 to 16/12/2017\r\nWin64/Turla.AA\r\n9ff4f59ca26388c37d0b1f0e0b22322d926e294a\r\nGazer loader x64\r\n16/02/2016 16:00:44\r\nadmin@ultimatecomsup.biz valid from 16/12/2015 to 16/12/2017\r\nhttps://github.com/eset/malware-ioc/tree/master/turla\r\nPage 3 of 10\n\nWin64/Turla.AA\r\n029aa51549d0b9222db49a53d2604d79ad1c1e59\r\nGazer loader x64\r\n18/02/2016 15:29:58\r\nadmin@ultimatecomsup.biz valid from 16/12/2015 to 16/12/2017\r\nWin64/Turla.AA\r\ncecc70f2b2d50269191336219a8f893d45f5e979\r\nGazer loader x64\r\n01/01/2017 08:39:30\r\nadmin@ultimatecomsup.biz valid from 16/12/2015 to 16/12/2017\r\nWin64/Turla.AG\r\n7fac4fc130637afab31c56ce0a01e555d5dea40d\r\nGazer loader x64\r\n11/06/2017 23:43:51\r\nadmin@ultimatecomsup.biz valid from 16/12/2015 to 16/12/2017\r\nWin64/Turla.AD\r\n5838A51426CA6095B1C92B87E1BE22276C21A044\r\nGazer loader x32\r\n19/06/2017 01:28:51\r\nadmin@ultimatecomsup.biz valid from 16/12/2015 to 16/12/2017\r\nWin32/Turla.CF\r\n3944253F6B7019EED496FAD756F4651BE0E282B4\r\nGazer loader x64\r\n19/06/2017 01:30:00\r\nadmin@ultimatecomsup.biz valid from 16/12/2015 to 16/12/2017\r\nWin64/Turla.AD\r\nhttps://github.com/eset/malware-ioc/tree/master/turla\r\nPage 4 of 10\n\n228da957a9ed661e17e00efba8e923fd17fae054\r\nGazer orchestrator x32\r\n05/02/2002 17:31:28\r\nnot signed\r\nWin32/Turla.CF\r\n295d142a7bdced124fdcc8edfe49b9f3acceab8a\r\nGazer orchestrator x32\r\n05/02/2002 17:31:28\r\nnot signed\r\nWin32/Turla.CF\r\n0f97f599fab7f8057424340c246d3a836c141782\r\nGazer orchestrator x32\r\n05/02/2002 17:31:28\r\nnot signed\r\nWin32/Turla.CF\r\ndbb185e493a0fdc959763533d86d73f986409f1b\r\nGazer orchestrator x32\r\n05/02/2002 17:31:28\r\nnot signed\r\nWin32/Turla.CC\r\n4701828dee543b994ed2578b9e0d3991f22bd827\r\nGazer orchestrator x64\r\n05/02/2002 17:34:25\r\nnot signed\r\nWin64/Turla.AA\r\n6fd611667ba19691958b5b72673b9b802edd7ff8\r\nhttps://github.com/eset/malware-ioc/tree/master/turla\r\nPage 5 of 10\n\nGazer orchestrator x64\r\n05/02/2002 17:34:25\r\nnot signed\r\nWin64/Turla.AA\r\nfcabeb735c51e2b8eb6fb07bda8b95401d069bd8\r\nGazer orchestrator x64\r\n05/02/2002 17:34:25\r\nnot signed\r\nWin64/Turla.AA\r\n75831df9cbcfd7bf812511148d2a0f117324a75f\r\nGazer orchestrator x32\r\n04/10/2002 18:31:28\r\nnot signed\r\nWin32/Turla.CC\r\nbae3ae65c32838fb52a0f5ad2cde8659d2bff9f3\r\nGazer orchestrator x32\r\n04/10/2002 18:31:28\r\nnot signed\r\nWin32/Turla.CC\r\n37ff6841419adc51eeb8756660b2fb46f3eb24ed\r\nGazer orchestrator x64\r\n04/10/2002 18:33:02\r\nnot signed\r\nWin64/Turla.AA\r\n9e6de3577b463451b7afce24ab646ef62ad6c2bd\r\nGazer orchestrator x64\r\nhttps://github.com/eset/malware-ioc/tree/master/turla\r\nPage 6 of 10\n\n04/10/2002 18:33:02\r\nnot signed\r\nWin64/Turla.AA\r\n795c6ee27b147ff0a05c0477f70477e315916e0e\r\nGazer orchestrator x64\r\n04/10/2002 18:33:02\r\nnot signed\r\nWin64/Turla.AA\r\n8184ad9d6bbd03e99a397f8e925fa66cfbe5cf1b\r\nGazer orchestrator x64\r\n09/01/2016 19:28:29\r\nnot signed\r\nWin64/Turla.AA\r\n7ced96b08d7593e28fee616eccbc6338896517cf\r\nGazer orchestrator x64\r\n06/02/2016 19:29:04\r\nnot signed\r\nWin64/Turla.AA\r\n63c534630c2ce0070ad203f9704f1526e83ae586\r\nGazer orchestrator x64\r\n06/02/2016 19:29:04\r\nnot signed\r\nWin64/Turla.AA\r\n23f1e3be3175d49e7b262cd88cfd517694dcba18\r\nGazer orchestrator x64\r\n18/02/2016 15:29:32\r\nhttps://github.com/eset/malware-ioc/tree/master/turla\r\nPage 7 of 10\n\nnot signed\r\nWin64/Turla.AA\r\n7a6f1486269abdc1d658db618dc3c6f2ac85a4a7\r\nGazer orchestrator x64\r\n01/01/2017 08:39:19\r\nnot signed\r\nWin64/Turla.AG\r\n11B35320FB1CF21D2E57770D8D8B237EB4330EAA\r\nGazer orchestrator x64\r\n11/06/2017 23:42:28\r\nnot signed\r\nWin64/Turla.AD\r\nE8A2BAD87027F2BF3ECAE477F805DE13FCCC0181\r\nGazer orchestrator x32\r\n19/06/2017 01:28:21\r\nnot signed\r\nWin32/Turla.CF\r\n950F0B0C7701835C5FBDB6C5698A04B8AFE068E6\r\nGazer orchestrator x64\r\n19/06/2017 01:29:46\r\nnot signed\r\nWin64/Turla.AD\r\na5eec8c6aadf784994bf68d9d937bb7af3684d5c\r\nGazer comm x64\r\n05/02/2002 17:57:07\r\nadmin@solidloop.org valid from 14/10/2015 to 14/10/2016\r\nhttps://github.com/eset/malware-ioc/tree/master/turla\r\nPage 8 of 10\n\nWin64/Turla.AH\r\n411ef895fe8dd4e040e8bf4048f4327f917e5724\r\nGazer comm x32\r\n05/02/2002 17:58:22\r\nadmin@solidloop.org valid from 14/10/2015 to 14/10/2016\r\nWin32/Turla.CC\r\nc1288df9022bcd2c0a217b1536dfa83928768d06\r\nGazer comm x32\r\n06/02/2016 19:23:52\r\nnot signed\r\nWin32/Turla.CC\r\n4b6ef62d5d59f2fe7f245dd3042dc7b83e3cc923\r\nGazer comm x32\r\n11/06/2017 23:44:24\r\nnot signed\r\nWin32/Turla.CF\r\n7f54f9f2a6909062988ae87c1337f3cf38d68d35\r\nGazer wiper x32\r\n05/02/2002 17:39:07\r\nadmin@solidloop.org valid from 14/10/2015 to 14/10/2016\r\nWin32/Turla.CL\r\n27FA78DE705EBAA4B11C4B5FE7277F91906B3F92\r\nGazer wiper x32\r\n07/04/2016 15:04:24\r\nnot signed\r\nWin32/Turla.CL\r\nhttps://github.com/eset/malware-ioc/tree/master/turla\r\nPage 9 of 10\n\nSource: https://github.com/eset/malware-ioc/tree/master/turla\r\nhttps://github.com/eset/malware-ioc/tree/master/turla\r\nPage 10 of 10", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia" ], "references": [ "https://github.com/eset/malware-ioc/tree/master/turla" ], "report_names": [ "turla" ], "threat_actors": [], "ts_created_at": 1775791301, "ts_updated_at": 1775791338, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/66174a105244f393279b85f4cfd094691bda5270.pdf", "text": "https://archive.orkl.eu/66174a105244f393279b85f4cfd094691bda5270.txt", "img": "https://archive.orkl.eu/66174a105244f393279b85f4cfd094691bda5270.jpg" } }