mofksys | 061703ca7c53075cd29a8809fc00f09c0717eb0024827a8530951dbcce6e2dd3

General

Target
2026-07-18_c23f5fb082fc69ab58755b829fe18287_dark-comet_darkgate_elex_gcleaner_glassworm_stealc_stop_tofsee
Size 4.7MB
Sample260718-g7gh7aes5s
SHA256 061703ca7c53075cd29a8809fc00f09c0717eb0024827a8530951dbcce6e2dd3
MD5 c23f5fb082fc69ab58755b829fe18287
SHA1 e5e1340db86e8bfe58764d91243edd538aa50a5a
SHA512 2d66635b485b544d75f954581b494f105c34141b253c324ed2268b3f1ad63f1f17b072c881c220ab4a0b7f43c8eb25938ef0aa93cead48593991d165f2f4ce0f
SSDEEP 98304:zSnsmtk2acTnsmtk2ayxansmtk2aNYnsmtk2axtCXWPmm3YR4rhq:zcLFrLPxULgmLzyoa9q
TLSH
T1E6369E27F6809037D1334BB85C67A3A66829BE512F257C0F37E01F4C6E3964279752AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Targets

- Target
  2026-07-18_c23f5fb082fc69ab58755b829fe18287_dark-comet_darkgate_elex_gcleaner_glassworm_stealc_stop_tofsee
- Size 4.7MB
- SHA256 061703ca7c53075cd29a8809fc00f09c0717eb0024827a8530951dbcce6e2dd3
- MD5 c23f5fb082fc69ab58755b829fe18287
- SHA1 e5e1340db86e8bfe58764d91243edd538aa50a5a
- SHA512 2d66635b485b544d75f954581b494f105c34141b253c324ed2268b3f1ad63f1f17b072c881c220ab4a0b7f43c8eb25938ef0aa93cead48593991d165f2f4ce0f
- SSDEEP 98304:zSnsmtk2acTnsmtk2ayxansmtk2aNYnsmtk2axtCXWPmm3YR4rhq:zcLFrLPxULgmLzyoa9q
- TLSH
  T1E6369E27F6809037D1334BB85C67A3A66829BE512F257C0F37E01F4C6E3964279752AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery mofksys xred persistence worm macro
- Detects Mofksys worm
- Family: Mofksys
  Mofksys is a worm written in VisualBasic.
  worm mofksys
- Family: Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Modifies WinLogon for persistence
  persistence
- Modifies visibility of hidden/system files in Explorer
  defense_evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Suspicious Office macro
  Office document equipped with macros.
  macro
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2