MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4098f8a25a64b8bd44094fb72536eecd5b1e1a01bf15aa02984ee6fbd1137d76. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mofksys

Vendor detections: 14

Intelligence 14 IOCs YARA 15 File information Comments

SHA256 hash:	4098f8a25a64b8bd44094fb72536eecd5b1e1a01bf15aa02984ee6fbd1137d76
SHA3-384 hash:	60b285017642aa4553d9fd1c052121cf5efcebcd46a583e5478768bd4c4404e0b857ca4295848b11506637bce466bf2a
SHA1 hash:	91315c08c9d7df894f6058ed3cf65166e9c49dfa
MD5 hash:	4a581295434e5f8d6ff6aebcaef6f69b
humanhash:	river-maryland-helium-alanine
File name:	file
Download:	download sample
Signature	Mofksys Create hunting rule
File size:	1'611'428 bytes
First seen:	2025-08-19 14:28:33 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	8c16c795b57934183422be5f6df7d891 (36 x Mofksys, 18 x CryptOne, 6 x AveMariaRAT)
ssdeep	24576:PFOaj6qsgabtl9Z8Nx6AQ8DSoRPm/Rwn4o60OegX7Aozptl72NkoVl:t7s9bngNzv+DenO0Ervzd2Nkwl
Threatray	88 similar samples on MalwareBazaar
TLSH	T1FB75CF0BA2E50199DA73C278D0569317E772789917208FCF23D446682F73BE62ABD713
TrID	42.6% (.EXE) Win32 Executable (generic) (4504/4/1) 19.4% (.ICL) Windows Icons Library (generic) (2059/9) 18.9% (.EXE) Generic Win/DOS Executable (2002/3) 18.9% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
dhash icon	00928e8e8686b800 (21 x Mofksys, 9 x CryptOne, 5 x Amadey)
Reporter	jstrosch
Tags:	exe Mofksys

jstrosch

Found at hxxps://anonhax[.]site/uploads/6758e2eb94eb2_Viper_CRACKED.exe by #subcrawl

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2025-08-19 14:47:29 UTC

Tags:

auto-reg jeefo

Link:

https://app.any.run/tasks/595aceaf-fb78-41d1-bedc-bb464d2b0685

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/22196/

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68a48a4fc2f5296a1a284c58

Tags:

ransomware smtp sage

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a window

Creating a file in the Windows subdirectories

Creating a file

Creating a process from a recently created file

Running batch commands

Launching a process

Connection attempt

Sending a custom TCP request

DNS request

Sending an HTTP GET request

Creating a process with a hidden window

Enabling the 'hidden' option for recently created files

Setting a single autorun event

Enabling a "Do not show hidden files" option

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-vm base64 certutil lolbin overlay overlay threat visual_basic

Link:

https://www.filescan.io/uploads/68a48b7e419c816a6e8c16ef/reports/4debde58-748a-4faa-8b7f-3f1efad6b292/overview

Verdict:

Malicious

Labled as:

Gosys.B

Link:

https://www.hybrid-analysis.com/sample/4098f8a25a64b8bd44094fb72536eecd5b1e1a01bf15aa02984ee6fbd1137d76

Malware family:

MOFKSYS

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2186c284-246d-4342-bac2-311291892a2e

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/4098f8a25a64b8bd44094fb72536eecd5b1e1a01bf15aa02984ee6fbd1137d76

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4098f8a25a64b8bd44094fb72536eecd5b1e1a01bf15aa02984ee6fbd1137d76/

Threat name:

Win32.Trojan.Swisyn

Status:

Malicious

First seen:

2025-08-19 14:42:30 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 24 (100.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=icmpris2ms4l2rajj63sknxozvnr4gqbx4k2uauyj3tpxuitpv3a._file

Verdict:

malicious

Label(s):

mofksys

Result

Malware family:

n/a

Score:

10/10

Tags:

defense_evasion discovery persistence

Link:

https://tria.ge/reports/250819-rw3bmavlx4/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Drops file in Windows directory

Drops file in System32 directory

Adds Run key to start application

Executes dropped EXE

Modifies visibility of hidden/system files in Explorer

Verdict:

Malicious

Tags:

trojan Win.Trojan.VBGeneric-6735875-0

YARA:

Windows_Generic_Threat_7526f106 Windows_Generic_Threat_cbe3313a

Link:

https://app.threat.zone/submission/55472a68-376c-41bf-870a-6f6a937fcb72

Unpacked files

SH256 hash:

4098f8a25a64b8bd44094fb72536eecd5b1e1a01bf15aa02984ee6fbd1137d76

MD5 hash:

4a581295434e5f8d6ff6aebcaef6f69b

SHA1 hash:

91315c08c9d7df894f6058ed3cf65166e9c49dfa

Link:

https://www.unpac.me/results/895c05d1-a6e7-4492-a0e0-b846f77590e3/

SH256 hash:

1227c66dd0ecd15e4a37aec1864cf9b1e4bf80edad58c6d15124d19756a94b77

MD5 hash:

efacb1e93320bd7c040f0e6ca441d0b1

SHA1 hash:

6c2c284d18004ae770f9cac28c67803fad5c846c

Detections:

SUSP_PE_Discord_Attachment_Oct21_1

INDICATOR_SUSPICIOUS_EXE_DiscordURL

Link:

https://www.unpac.me/results/895c05d1-a6e7-4492-a0e0-b846f77590e3/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/4098f8a25a64/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4098f8a25a64b8bd44094fb72536eecd5b1e1a01bf15aa02984ee6fbd1137d76

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	dsc Create hunting rule
Author:	Aaron DeVera
Description:	Discord domains

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_SUSPICIOUS_EXE_DiscordURL Create hunting rule
Author:	ditekSHen
Description:	Detects executables Discord URL observed in first stage droppers

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	SEH__vba Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SUSP_Imphash_Mar23_2 Create hunting rule
Author:	Arnim Rupp (https://github.com/ruppde)
Description:	Detects imphash often found in malware samples (Zero hits with with search for 'imphash:x p:0' on Virustotal)
Reference:	Internal Research

Rule name:	SUSP_PE_Discord_Attachment_Oct21_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)
Reference:	Internal Research

Rule name:	SUSP_Websites Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects the reference of suspicious sites that might be used to download further malware

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	Windows_Generic_Threat_7526f106 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Generic_Threat_cbe3313a Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mofksys

exe 4098f8a25a64b8bd44094fb72536eecd5b1e1a01bf15aa02984ee6fbd1137d76

(this sample)

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/22196/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high
CHECK_TRUST_INFO	Requires Elevated Execution (level:requireAdministrator)	high

Reviews

ID	Capabilities	Evidence
VB_API	Legacy Visual Basic API used	MSVBVM60.DLL::__vbaCopyBytes MSVBVM60.DLL::__vbaSetSystemError MSVBVM60.DLL::__vbaExitProc MSVBVM60.DLL::__vbaObjSetAddref MSVBVM60.DLL::EVENT_SINK_AddRef MSVBVM60.DLL::__vbaFileOpen

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample