mofksys | df30fca5475580f717cf7ccb1bdc665e217c9c14323f3881bc964291b991d766

Analysis

max time kernel
151s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-18_3247a2054a979aee9645ee5a5f043e6f_dark-comet_darkgate_elex_gcleaner_glassworm_wannacry.exe
Size 27.1MB
Sample261018-tljsmsgs7w
SHA256 df30fca5475580f717cf7ccb1bdc665e217c9c14323f3881bc964291b991d766
MD5 3247a2054a979aee9645ee5a5f043e6f
SHA1 3221fb36ba69a9cc0bf48d7bb425608204f239af
SHA512 3c723a1f1afacd6f16b2d039412d275896be35c6f018792ab67898ad3a0fcd74e21161c0e9e70f30bd98452713a0b21b5b6a64a80d9fb9eb2b80a41e69a69262
SSDEEP 393216:mXvEbo+9St2HBVfe85kI1Qfbgispu4HWQXU52uz74fsYvG91pTO:mf2z8UhFHG0yEf4uXkcw0fsYvG9G
TLSH
T1C3577D22F680943BD1221A784C6BE3B56935BE212F24690B3BE42E4F7E397427C75357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery mofksys xred persistence worm

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Family: Mofksys
Mofksys is a worm written in VisualBasic.
worm mofksys
Family: Xred
Xred is backdoor written in Delphi.
backdoor xred

Detects Mofksys worm 12 IoCs

resource	yara_rule
behavioral2/memory/3908-0-0x0000000000400000-0x000000000042F000-memory.dmp	family_mofksys
behavioral2/files/0x000d00000001c588-14.dat	family_mofksys
behavioral2/files/0x000e00000001c58c-26.dat	family_mofksys
behavioral2/files/0x000e00000001c58e-34.dat	family_mofksys
behavioral2/files/0x000e00000001c592-47.dat	family_mofksys
behavioral2/memory/4256-89-0x0000000000400000-0x000000000042F000-memory.dmp	family_mofksys
behavioral2/memory/2808-93-0x0000000000400000-0x000000000042F000-memory.dmp	family_mofksys
behavioral2/files/0x000e00000001c596-94.dat	family_mofksys
behavioral2/memory/5584-92-0x0000000000400000-0x000000000042F000-memory.dmp	family_mofksys
behavioral2/memory/3908-96-0x0000000000400000-0x000000000042F000-memory.dmp	family_mofksys
behavioral2/memory/2816-143-0x0000000000400000-0x000000000042F000-memory.dmp	family_mofksys
behavioral2/memory/3464-144-0x0000000000400000-0x000000000042F000-memory.dmp	family_mofksys

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 8 IoCs

pid	Process
2732	2026-10-18_3247a2054a979aee9645ee5a5f043e6f_dark-comet_darkgate_elex_gcleaner_glassworm_wannacry.exe
2808	icsys.icn.exe
2816	explorer.exe
5584	spoolsv.exe
3464	svchost.exe
4256	spoolsv.exe
5592	Synaptics.exe
3452	Synaptics.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	2026-10-18_3247a2054a979aee9645ee5a5f043e6f_dark-comet_darkgate_elex_gcleaner_glassworm_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Synaptics.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Synaptics.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-18_3247a2054a979aee9645ee5a5f043e6f_dark-comet_darkgate_elex_gcleaner_glassworm_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-18_3247a2054a979aee9645ee5a5f043e6f_dark-comet_darkgate_elex_gcleaner_glassworm_wannacry.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1512	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2808	icsys.icn.exe
2808	icsys.icn.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
3464	svchost.exe
3464	svchost.exe
3464	svchost.exe
3464	svchost.exe
2816	explorer.exe
2816	explorer.exe
3464	svchost.exe
3464	svchost.exe
2816	explorer.exe
2816	explorer.exe
3464	svchost.exe
3464	svchost.exe
2816	explorer.exe
2816	explorer.exe
3464	svchost.exe
3464	svchost.exe
2816	explorer.exe
2816	explorer.exe
3464	svchost.exe
3464	svchost.exe
2816	explorer.exe
2816	explorer.exe
3464	svchost.exe
3464	svchost.exe
2816	explorer.exe
2816	explorer.exe
3464	svchost.exe
3464	svchost.exe
3464	svchost.exe
3464	svchost.exe
2816	explorer.exe
2816	explorer.exe
3464	svchost.exe
3464	svchost.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
2816	explorer.exe
3464	svchost.exe
3464	svchost.exe
3464	svchost.exe
2816	explorer.exe
2816	explorer.exe
3464	svchost.exe
2816	explorer.exe
2816	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2816	explorer.exe
3464	svchost.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
3908	2026-10-18_3247a2054a979aee9645ee5a5f043e6f_dark-comet_darkgate_elex_gcleaner_glassworm_wannacry.exe
3908	2026-10-18_3247a2054a979aee9645ee5a5f043e6f_dark-comet_darkgate_elex_gcleaner_glassworm_wannacry.exe
2808	icsys.icn.exe
2808	icsys.icn.exe
2816	explorer.exe
2816	explorer.exe
5584	spoolsv.exe
5584	spoolsv.exe
3464	svchost.exe
3464	svchost.exe
4256	spoolsv.exe
4256	spoolsv.exe
2816	explorer.exe
2816	explorer.exe
1512	EXCEL.EXE
1512	EXCEL.EXE
1512	EXCEL.EXE
1512	EXCEL.EXE

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 2732	3908	2026-10-18_3247a2054a979aee9645ee5a5f043e6f_dark-comet_darkgate_elex_gcleaner_glassworm_wannacry.exe	88
PID 3908 wrote to memory of 2808	3908	2026-10-18_3247a2054a979aee9645ee5a5f043e6f_dark-comet_darkgate_elex_gcleaner_glassworm_wannacry.exe	89
PID 2808 wrote to memory of 2816	2808	icsys.icn.exe	90
PID 2816 wrote to memory of 5584	2816	explorer.exe	91
PID 5584 wrote to memory of 3464	5584	spoolsv.exe	92
PID 3464 wrote to memory of 4256	3464	svchost.exe	93
PID 2732 wrote to memory of 5592	2732	2026-10-18_3247a2054a979aee9645ee5a5f043e6f_dark-comet_darkgate_elex_gcleaner_glassworm_wannacry.exe	95
PID 3464 wrote to memory of 2548	3464	svchost.exe	96
PID 3464 wrote to memory of 2456	3464	svchost.exe	104
PID 3464 wrote to memory of 5052	3464	svchost.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-10-18_3247a2054a979aee9645ee5a5f043e6f_dark-comet_darkgate_elex_gcleaner_glassworm_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-18_3247a2054a979aee9645ee5a5f043e6f_dark-comet_darkgate_elex_gcleaner_glassworm_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3908
- \??\c:\users\admin\appdata\local\temp\2026-10-18_3247a2054a979aee9645ee5a5f043e6f_dark-comet_darkgate_elex_gcleaner_glassworm_wannacry.exe
  c:\users\admin\appdata\local\temp\2026-10-18_3247a2054a979aee9645ee5a5f043e6f_dark-comet_darkgate_elex_gcleaner_glassworm_wannacry.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\ProgramData\Synaptics\Synaptics.exe
    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5592
- C:\Users\Admin\AppData\Local\icsys.icn.exe
  C:\Users\Admin\AppData\Local\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2808
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of hidden/system files in Explorer
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - \??\c:\windows\system\spoolsv.exe
      c:\windows\system\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5584
    - - \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        5⤵
        Modifies WinLogon for persistence
        Modifies visibility of hidden/system files in Explorer
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3464
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4256
      - C:\Windows\SysWOW64\at.exe
        
        at 17:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2548
      - C:\Windows\SysWOW64\at.exe
        
        at 17:12 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2456
      - C:\Windows\SysWOW64\at.exe
        
        at 17:13 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5052

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1512

C:\ProgramData\Synaptics\Synaptics.exe
C:\ProgramData\Synaptics\Synaptics.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 753KB
SHA256 940c677b64314a76c553ef0b9c1f8152fa2fa6158b95a1ac81833a2dd640cac1
MD5 e5e9258d0710994253845556e96602f8
SHA1 28682d59c6f2d67a56a53cc125747923559f1a6e
SHA512 1cf0a58a7819176062707670da3d5fbcf735dec6c35085fbb0b34ad36f462100f223d67512b450b65759037d8e6ad6b455a30d148f6a6992d392fb0fcbcf997e
SSDEEP 12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9ISC:ansJ39LyjbJkQFMhmC+6GD9s
TLSH
T137F47D33F2D19437D1321A3D9C5BA3A9582ABE512E38794A3BF41E4C5F3D68238652D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-10-18_3247a2054a979aee9645ee5a5f043e6f_dark-comet_darkgate_elex_gcleaner_glassworm_wannacry.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-10-18_3247a2054a979aee9645ee5a5f043e6f_dark-comet_darkgate_elex_gcleaner_glassworm_wannacry.exe
Size 26.9MB
SHA256 6ebd072012e8f55851a4fff4ed06294db3d470672c8d18d54128be7cfe370fb6
MD5 9445412ba77d6b5e82b38776a1072629
SHA1 dc1849368e2e916b4020243279dde0c77f4b2307
SHA512 d0cb70c7103089531bb20eb00cb0db4d3a16272c7517bc4c6fe08af7a1d6aab4748da8a45caf3cf6e9a52b6b697832d430935d9e2858008c143572ef47912507
SSDEEP 393216:DvEbo+9St2HBVfe85kI1Qfbgispu4HWQXU52uz74fsYvG91pTI:z2z8UhFHG0yEf4uXkcw0fsYvG9A
TLSH
T180577D22F280943BD1221A784C6BE3B56935BE212F24694B3BE42E4F7E397427C75357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oSLDGfAh.xlsm

Path C:\Users\Admin\AppData\Local\Temp\oSLDGfAh.xlsm
Size 17KB
SHA256 8a53a911752049160273f080c9631f519692de0aecd081b7b7c0239c5656f387
MD5 8f3c7fbc1e051b36696dbd67e8ed4249
SHA1 b6b3e8ff0aecce4e85ca9819cce2c9cce7a14c67
SHA512 4ecb5f18cee44ef986845c49b2aa84c115180e277b866c4ebf9ccda94c0992cb2d2f8c0123ad0fb5558f63e0b37d6547f5e5971832ee44c55edd44521dd950a5
SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPl2G+Q16BrvPJa37:oUatwNSSvY2IdkLQIBLJw7
TLSH
T10C82BF276558766BC432603A959B283C0B0D639D361FD90872453B9695CF09F8FDB0CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Users\Admin\AppData\Local\icsys.icn.exe
Size 206KB
SHA256 e0090ef2e78fd7eb5e58d6206e43a03cda6190974f80572227f1e4ad123ae175
MD5 d61db67cb6ba54834f34add5c65b5989
SHA1 2a18d671be78ac0dddb16f41e67794e4d4b065bf
SHA512 c952c3ec603b35715e7e4d46e40580e2218c33d0e201b876c9029b2e03e35b4a2441ce8c8f0bc3a4f317c89d1ed9b8c107a6d18113655bcd645d89d536afc004
SSDEEP 3072:gvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unj/:gvEN2U+T6i5LirrllHy4HUcMQY6e
TLSH
T19C24E82BBE04643ED8A7C6F01426E5A5B6326E351B94EC0B6391AF4A34B5603F1F531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 206KB
SHA256 6fb14f6d934d6ad5a4983becfc4bf274593ead34656196de7277867efba78f33
MD5 afdaeb813b49fba4ccd55d920cc77bad
SHA1 5b8a0836d9eb7b7b73ef0f9df951bc711626362e
SHA512 0abbbfd7d621816ea44fc76af84ee2e520c5ee17061699217dc293d64330e0aee1649e5452833e6c96183304d924821cc5159f3b8e88558bf900f79328c5d7d9
SSDEEP 3072:gvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unjv:gvEN2U+T6i5LirrllHy4HUcMQY6S
TLSH
T1E324082BEE04643BE8A786F0546AB576BA252D310BD06C5B53D2AF4634B1943F1F132F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 206KB
SHA256 7324d67b06ec29a502db5d65879a6f132a266772caa73956e429f5e2d1743063
MD5 b90183a147a56ba5f7a4fd51480ba554
SHA1 79ffe0977eedf66c2bb01ee5dd9b3a8ae8a62c29
SHA512 bd45d2c54bc1ccc91ea83f1a33e7e80e01c528d181cce2a7946358ae2590747d21f91616dd16ea2512542841807ff0b0a0c4bd1cb86fffe47fa893df6ad277a8
SSDEEP 3072:gvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unjv:gvEN2U+T6i5LirrllHy4HUcMQY6g
TLSH
T15A24EA6BFA00743ED8B796F0685AA6AAB9213D261B919C0F17C1AF853571603F1F431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 206KB
SHA256 dd8e4ddfebb2dcfa5e4094ca1f3cb05e2ad4ce8908df7a8ac3461ace13fb7e14
MD5 870e2d7bc5f74b0909d2c53238678f19
SHA1 cc049ddd1c5b3f5e2ae55a2e2363924715ed96fe
SHA512 fbf68f7fd9a1f4a92d7df7f56813906d4e908cd23a3326c38ac2e112d7144f86be345d4f1d4eb6b13932673b0f5274b03a6b1c3e3f85064bf7dadaa08d726469
SSDEEP 3072:gvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unjN:gvEN2U+T6i5LirrllHy4HUcMQY6W
TLSH
T1CC24F82BEA05753AD493C9F0582675AABA312E361FD1AC0B53D1AB863471643F1F231F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path \??\c:\windows\system\explorer.exe
Size 206KB
SHA256 365cd6e85ccc4ac7fa055edee3a2e562da03e636c00dc3524ff6cb50c8f60d69
MD5 f9e5a8b68f0ec52b9c93a4e4cfe77e1f
SHA1 6f48dbb20d84228f52ddaad901cad36f82765e9e
SHA512 069e922e38398017422c8cf676876c2c339959a12f66528fa3fdd33d996e81a97e7524d0f2e1e2a74c5f1cb6d056cfeddbfb6599c488056ccf9ef500b185ca55
SSDEEP 6144:gvEN2U+T6i5LirrllHy4HUcMQY6IGmGmGmGmGmGmGmGmGmGmGmGmGmGmGmGmGmGG:aENN+T5xYrllrU7QY6IGmGmGmGmGmGm7
TLSH
T1E724F92EEA40753ED85286F1182AA166BA313E711FD1EC4BA7D19F0634B2503B5F532F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1512-103-0x00007FFA9EBB0000-0x00007FFA9EBC0000-memory.dmp

Download

memory/1512-98-0x00007FFAA18E0000-0x00007FFAA18F0000-memory.dmp

Download

memory/1512-100-0x00007FFAA18E0000-0x00007FFAA18F0000-memory.dmp

Download

memory/1512-102-0x00007FFAA18E0000-0x00007FFAA18F0000-memory.dmp

Download

memory/1512-104-0x00007FFA9EBB0000-0x00007FFA9EBC0000-memory.dmp

Download

memory/1512-101-0x00007FFAA18E0000-0x00007FFAA18F0000-memory.dmp

Download

memory/1512-99-0x00007FFAA18E0000-0x00007FFAA18F0000-memory.dmp

Download

memory/2732-11-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/2732-88-0x0000000000400000-0x0000000001EE1000-memory.dmp

Download

memory/2732-10-0x0000000002230000-0x0000000002231000-memory.dmp

Download

memory/2808-93-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2816-143-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3452-97-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/3464-144-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3908-0-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3908-96-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4256-89-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5584-92-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5592-109-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/5592-140-0x0000000000400000-0x00000000004C2000-memory.dmp

Download