Extracted

• • Target
    91001693548d2e77343744b0212982aaba6a71cfa6e98f258b0970ab88b0c086
  • Size 2.2MB
  • SHA256 91001693548d2e77343744b0212982aaba6a71cfa6e98f258b0970ab88b0c086
  • MD5 ed25410670756a556edabad9afc7ce4c
  • SHA1 48074e014b331a9a6d9985d03381bc4d7836dcca
  • SHA512 959048e9576c64389526790654775e3fbfcc963ab8c1a2da09f2b6cc7de29555f0753dec52000823505c162ebe804bd29bfe240c213361a39e8b3bb0ecfab761
  • SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZm:0UzeyQMS4DqodCnoe+iitjWwwq
  • TLSH
    T155A57D3BA0F49CB9F0647EF58247C16E72152C59A9747D1802E92BFD5ABC882FD0D1A3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverymofksysponypersistenceprivilege_escalationratspywarestealerworm

  • Detects Mofksys worm

  • Family: Mofksys

    Mofksys is a worm written in VisualBasic.

    wormmofksys

  • Family: Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies WinLogon for persistence

    persistence

  • Modifies visibility of hidden/system files in Explorer

    defense_evasion

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1