1. Home
  2. Software
  3. TinyTurla

TinyTurla

TinyTurla is a backdoor that has been used by Turla against targets in the US, Germany, and Afghanistan since at least 2020.[1]

ID: S0668
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Contributors: Kyaw Pyiyt Htet, @KyawPyiytHtet; Massimiliano Romano, BT Security
Version: 1.1
Created: 02 December 2021
Last Modified: 26 March 2023
Version Permalink
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

TinyTurla can use HTTPS in C2 communications.[1]
Enterprise T1059 .003 Command and Scripting Interpreter: Windows Command Shell

TinyTurla has been installed using a .bat file.[1]
Enterprise T1005 Data from Local System

TinyTurla can upload files from a compromised host.[1]
Enterprise T1573 .002 Encrypted Channel: Asymmetric Cryptography

TinyTurla has the ability to encrypt C2 traffic with SSL/TLS.[1]
Enterprise T1008 Fallback Channels

TinyTurla can go through a list of C2 server IPs and will try to register with each until one responds.[1]
Enterprise T1105 Ingress Tool Transfer

TinyTurla has the ability to act as a second-stage dropper used to infect the system with additional malware.[1]
Enterprise T1036 .004 Masquerading: Masquerade Task or Service

TinyTurla has mimicked an existing Windows service by being installed as Windows Time Service.[1]
.005 Masquerading: Match Legitimate Name or Location

TinyTurla has been deployed as w64time.dll to appear legitimate.[1]
Enterprise T1112 Modify Registry

TinyTurla can set its configuration parameters in the Registry.[1]
Enterprise T1106 Native API

TinyTurla has used WinHTTP, CreateProcess, and other APIs for C2 communications and other functions.[1]
Enterprise T1027 .011 Obfuscated Files or Information: Fileless Storage

TinyTurla can save its configuration parameters in the Registry.[1]
Enterprise T1012 Query Registry

TinyTurla can query the Registry for its configuration information.[1]
Enterprise T1029 Scheduled Transfer

TinyTurla contacts its C2 based on a scheduled timing set in its configuration.[1]
Enterprise T1569 .002 System Services: Service Execution

TinyTurla can install itself as a service on compromised machines.[1]

Groups That Use This Software

ID Name References
G0010 Turla

[1]

References

  1. Cisco Talos. (2021, September 21). TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines. Retrieved December 2, 2021.