Turkojan

Overview

Backdoor:Win32/Turkojan is a classic, highly notorious Remote Access Trojan (RAT) originating from Turkey in the mid-2000s. Widely distributed on hacker forums alongside tools like ProRat, Turkojan was heavily utilized by script kiddies and low-tier cybercriminals. It is known for its aggressive system subversion techniques, its comprehensive suite of espionage tools, and its frequent use in deploying destructive 'joke' payloads.

Understanding Turkojan
To a victim, a Turkojan infection often manifests as bizarre and terrifying computer behavior: the CD-ROM drive opening and closing, the mouse moving on its own, the screen flipping upside down, or sudden system reboots. For a security analyst, Turkojan represents a noisy but highly capable backdoor. Once installed, it grants a remote attacker complete, GUI-based administrative control over the infected machine, allowing for data theft, keylogging, and the deployment of further malware.

Execution and Remote Control Mechanics
Turkojan consists of a 'Client' (used by the attacker) and a 'Server' (the malware payload deployed to the victim). The server payload was typically disguised as a game, a crack, or a picture, and distributed via spam or P2P networks (`T1204.002`). Upon execution, it aggressively establishes persistence, often copying itself to the Windows directory and creating multiple Registry Run keys (`T1547.001`). To evade detection, it utilizes rootkit-like techniques (often injecting into `explorer.exe`) to hide its process, files, and the open network port (`T1055`). It opens a listening port and waits for the attacker to connect (`T1090`). The attacker then uses the Turkojan Client GUI to execute commands: logging keystrokes (`T1056.001`), stealing saved passwords, capturing webcam footage, or executing destructive 'fun' commands that disable the keyboard or format drives.

Indicators of Compromise & Impact
The impact is total endpoint compromise, data theft, and severe disruption of services. Incident responders will observe anomalous listening ports and inbound connections from unknown IPs. EDR logs will flag unauthorized modifications to the Registry, the creation of hidden files in the Windows folder, and the injection of code into standard system processes.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.001: Implement Endpoint Detection and Response (EDR) to monitor for suspicious API calls related to keystroke interception. Enforce Multi-Factor Authentication (MFA) to render stolen passwords useless.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_TURKOJAN {
    meta:
        description = "Detects Turkojan (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "turkojan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Turkojan Activity
id: 2026f58b44f93fbb7ea1f16d8539db57
status: experimental
description: Detects generic indicators of the turkojan malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*turkojan*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate the endpoint from the network; an active adversary is likely controlling the machine and may be viewing the screen.
2. Assume all local credentials, passwords, and sensitive files on the machine have been stolen or compromised.
3. Do not attempt to 'clean' the machine manually; Turkojan utilizes aggressive hiding techniques and often drops secondary backdoors.
4. Perform a complete bare-metal rebuild of the operating system after capturing forensic evidence (RAM dump and disk image).

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not engage with the attacker if they initiate a chat session through the RAT; immediately disconnect the network cable.
2. Avoid relying solely on software firewalls to block the connection, as Turkojan actively attempts to disable or bypass local security software.

References & External Analysis

• Search "turkojan" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Oficla
• Tear
• Kelvir
• Driverupdate
• Ggdoor

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/turkojan.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.