MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 769c2febefd0402ee34d4c1bbd4aee8f6b6b660c22ac74e212765978ae3e903f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Worm.Mofksys


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 769c2febefd0402ee34d4c1bbd4aee8f6b6b660c22ac74e212765978ae3e903f
SHA3-384 hash: 1c7938f3baca99945fcbc87af7088b4a9b7e4734cade19d91b04dbe6665a4b3104223188be8337a4cd214cca163e3bcc
SHA1 hash: f4e5c27fcc33ba0080d98b5f6539aeffc133582f
MD5 hash: 610f0cefe2baa978ab137a80e41c5001
humanhash: magazine-kansas-king-lion
File name:769c2febefd0402ee34d4c1bbd4aee8f6b6b660c22ac74e212765978ae3e903f
Download: download sample
Signature Worm.Mofksys
Create hunting rule
File size:966'656 bytes
First seen:2025-11-06 10:33:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:Kj7kHwlBqGGCAEBf7B72Cl/9BoxE0RfTbFn:ZDGVxtqCllaxEYF
TLSH T1C92512597650C827DA6293780870F3B4237A5DE8A120D797AFEC7EDFB9A9F014D10983
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10522/11/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4504/4/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
Reporter adrian__luca
Tags:exe Worm.Mofksys

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
769c2febefd0402ee34d4c1bbd4aee8f6b6b660c22ac74e212765978ae3e903f
Verdict:
Malicious activity
Analysis date:
2025-11-06 13:35:13 UTC
Tags:
auto-sch-xml
Link:
https://app.any.run/tasks/050322d4-3aec-414a-b96b-2e0aae2c9ea2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/35774/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=690c79925a5ed7864e2371a2
Tags:
micro spawn shell
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a file
Сreating synchronization primitives
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Unauthorized injection to a system process
Gathering data
Verdict:
Malicious
Labled as:
Jalapeno.Generic
Link:
https://www.hybrid-analysis.com/sample/769c2febefd0402ee34d4c1bbd4aee8f6b6b660c22ac74e212765978ae3e903f
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-10-14T01:37:00Z UTC
Last seen:
2025-11-07T05:55:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/769c2febefd0402ee34d4c1bbd4aee8f6b6b660c22ac74e212765978ae3e903f/results?tab=lookup
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/555f4c53-7c49-462f-963e-1a58bf95ac0c
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/769c2febefd0402ee34d4c1bbd4aee8f6b6b660c22ac74e212765978ae3e903f
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.35 Win 32 Exe x86
Link:
https://app.malva.re/file/610f0cefe2baa978ab137a80e41c5001
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/769c2febefd0402ee34d4c1bbd4aee8f6b6b660c22ac74e212765978ae3e903f/
Threat name:
Win32.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2025-10-14 04:34:05 UTC
File Type:
PE (.Net Exe)
Extracted files:
17
AV detection:
27 of 36 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=o2oc727p2bac5y2njqn32sxor5vwwzqmekwhjyqsozmxrlr6sa7q._file
Result
Malware family:
mofksys
Create hunting rule
Score:
  10/10
Tags:
family:mofksys discovery execution persistence worm
Link:
https://tria.ge/reports/251106-mlme7szmfv/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Uses the VBS compiler for execution
Command and Scripting Interpreter: PowerShell
Detects Mofksys worm
Mofksys
Mofksys family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/21f121f6-9f7c-4a8a-ae82-c90fde506203
Unpacked files
SH256 hash:
769c2febefd0402ee34d4c1bbd4aee8f6b6b660c22ac74e212765978ae3e903f
MD5 hash:
610f0cefe2baa978ab137a80e41c5001
SHA1 hash:
f4e5c27fcc33ba0080d98b5f6539aeffc133582f
Link:
https://www.unpac.me/results/cd39eeaf-b42f-4cc3-a449-bf22f683f1ee/
SH256 hash:
48b5be822fd1fb1a8718c42bb18374830a19d924ae904042978c70fb5945a123
MD5 hash:
134a72054b38348d8fcda48656d4554b
SHA1 hash:
31acd62600fb6bf29b0e8a00109744a539f412de
Detections:
darkcloudstealer
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_CC_Regex
Create hunting rule
MALWARE_Win_A310Logger
Create hunting rule
MALWARE_Win_DarkCloud
Create hunting rule
Link:
https://www.unpac.me/results/cd39eeaf-b42f-4cc3-a449-bf22f683f1ee/
SH256 hash:
37003518633d127c6ef4121bd78ae4685b10010173239e72d3b54d84099b4612
MD5 hash:
03de49bdfa3727429fb8591caf4c3756
SHA1 hash:
571f14cdc8ae85f4049284e16a9509047680fff2
Link:
https://www.unpac.me/results/cd39eeaf-b42f-4cc3-a449-bf22f683f1ee/
SH256 hash:
395255eb1d2da75d185ce6bdd80aab9deabdda0824ae8bdd860fff6427e7a40f
MD5 hash:
d81f7ffebeff00617749fc4cc2203ea1
SHA1 hash:
7124ecbc4fe5a6ed32a2b7c2a4d4c79662144e03
Detections:
win_mofksys_auto
Create hunting rule
SUSP_Imphash_Mar23_2
Create hunting rule
Link:
https://www.unpac.me/results/cd39eeaf-b42f-4cc3-a449-bf22f683f1ee/
Parent samples :
1d723d2030385c01e1c22326dae212bab15cd09e9dc3b2c8a439cf039fccf90b
d4409a190a74dd98d16c9818b60040256a024733be1e9f151dd46e3c4243abcb
d0a427ef5fa5496840ff480c1ba3f2b4a533d516f6fff8b012e131a4d5f6ddc6
769c2febefd0402ee34d4c1bbd4aee8f6b6b660c22ac74e212765978ae3e903f
SH256 hash:
88139123e61d62fca49adc276cdbbbe1af9500a6e507c93500924028bed6ae36
MD5 hash:
9a787f48a657e34d08fe627820f450aa
SHA1 hash:
79f0b64f6f9068ed3f269a6d6cc0337cf8b0d052
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/cd39eeaf-b42f-4cc3-a449-bf22f683f1ee/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/769c2febefd0402ee34d4c1bbd4aee8f6b6b660c22ac74e212765978ae3e903f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/35774/

Comments