Extracted

• • Target
    15650132b841c446b5f0d3068c66e91d760c1f7c9cdb55d6f914c012ae584ad0
  • Size 2.2MB
  • SHA256 15650132b841c446b5f0d3068c66e91d760c1f7c9cdb55d6f914c012ae584ad0
  • MD5 b368ae61d745d92605c2e5a62b3aae12
  • SHA1 47eb6e2f3af426b0f450431fc2a17f8a661bf1b7
  • SHA512 e2847dcfe98347adcdfbc3cfb6b853732f98aa057bb92edbe35dcb8c69752bfc6626991fa8ac9acb3c26776920eb5e675171a94796b2515d1dd6183cfeb517b8
  • SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZq:0UzeyQMS4DqodCnoe+iitjWwwu
  • TLSH
    T18CA59E3760F0B86DF4A73EF5835287AE60127884FD557B4912926FBA0D78442FA0E2D7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverymofksysponypersistenceprivilege_escalationratspywarestealerworm

  • Detects Mofksys worm

  • Family: Mofksys

    Mofksys is a worm written in VisualBasic.

    wormmofksys

  • Family: Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies WinLogon for persistence

    persistence

  • Modifies visibility of hidden/system files in Explorer

    defense_evasion

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1