Extracted

• • Target
    2026-06-01_a7a24e96feda94dce2241e156aeb5690_amadey_coinminer_cryptbot_darkgate_elex_glassworm_remcos_rhadamanthys_sliver_smoke-loader_wannacry
  • Size 18.9MB
  • SHA256 e9b82fbd044bb1ca66f8a877e1978ecd60c6c1eb566add3bbff2c08f930f9b43
  • MD5 a7a24e96feda94dce2241e156aeb5690
  • SHA1 e0120e77bd3f40ecb77c951871336a7ff092ef4e
  • SHA512 c92bc6adbbbc638643c4cb97e69fd3665a52c8db8e0b8fe56974b7258a88006311993b1e34457d249cb3b8c62b8c9e0c79e15dd8a285a1be1c49e2ff3276ec21
  • SSDEEP 393216:zdCqFTywoCkhfO/zFXGW/F/P9wXiXzThRmeC/+pWt0p7:zdXFTXRkdObGXYztRyMa01
  • TLSH
    T19B17BF11FBD600B0F673927085AAD73BC6377A110531DEAFF74C8A497B33A915A2A316
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaredefense_evasiondiscoveryexecutionmofksyspersistencespywareworm

  • Detects Mofksys worm

  • Family: Mofksys

    Mofksys is a worm written in VisualBasic.

    wormmofksys

  • Modifies WinLogon for persistence

    persistence

  • Modifies visibility of hidden/system files in Explorer

    defense_evasion

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2