Malware

PE_MOFKSYS.A

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

19 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1091Replication Through Removable MediaEvidence1

It infects all .EXE files inside the folders that was accessed by the user in all physical and removable drives.

T1189Drive-by CompromiseEvidence1

arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Execution

2 techniques

T1053Scheduled Task/JobEvidence1

It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.

T1059Command and Scripting InterpreterEvidence1

Backdoor Routine This file infector executes the following commands from a remote malicious user

Persistence

4 techniques

T1053Scheduled Task/JobEvidence1

It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.

T1112Modify RegistryEvidence1

It modifies registry entries to disable the following system services... It modifies the following registry entries to hide files with Hidden attributes...

T1547.001Registry Run Keys / Startup FolderEvidence1

adds the following registry entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce ... HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ...

T1547.004Winlogon Helper DLLEvidence1

It modifies the following registry entries to ensure it automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell = "%Windows%\explorer.exe, %System%\explorer.exe"

Privilege Escalation

3 techniques

T1053Scheduled Task/JobEvidence1

It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.

T1547.001Registry Run Keys / Startup FolderEvidence1

T1547.004Winlogon Helper DLLEvidence1

Stealth

3 techniques

T1036MasqueradingEvidence1

drops the following files: %Windows%\spoolsv.exe ... %Windows%\svchost.exe ... %System%\explorer.exe ...

T1497.001System ChecksEvidence1

Backdoor Routine ... Monitor window titles

T1564.001Hidden Files and DirectoriesEvidence1

It modifies the following registry entries to hide files with Hidden attributes: ... ShowSuperHidden = "0"

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

It modifies registry entries to disable the following system services... It modifies the following registry entries to hide files with Hidden attributes...

Credential Access

2 techniques

T1056.001KeyloggingEvidence1

Backdoor Routine ... Log Keystrokes

T1056.002GUI Input CaptureEvidence1

Backdoor Routine ... Monitor mouse clicks

Discovery

1 technique

T1497.001System ChecksEvidence1

Backdoor Routine ... Monitor window titles

Lateral Movement

2 techniques

T1021.002SMB/Windows Admin SharesEvidence1

It also shares the following folder in the network: %System Root%\Documents and Settings\All User\Application Data

T1091Replication Through Removable MediaEvidence1

It infects all .EXE files inside the folders that was accessed by the user in all physical and removable drives.

Collection

5 techniques

T1005Data from Local SystemEvidence1

Information Theft This file infector steals the following information: Email configurations ... Instant messenger credentials Websites visited Clipboard contents

T1056.001KeyloggingEvidence1

Backdoor Routine ... Log Keystrokes

T1056.002GUI Input CaptureEvidence1

Backdoor Routine ... Monitor mouse clicks

T1113Screen CaptureEvidence1

Backdoor Routine ... Capture screen

T1115Clipboard DataEvidence1

Information Theft This file infector steals the following information: ... Clipboard contents

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

It connects to the following URL(s) to send and receive commands from a remote malicious user

T1105Ingress Tool TransferEvidence1

Backdoor Routine ... Download other files

Exfiltration

1 technique

T1048Exfiltration Over Alternative ProtocolEvidence1

uses its own SMTP engine to send the stolen data using the following domain server: {BLOCKED}1@gmail.com ...

INDICATORS OF COMPROMISE

IOCs tracked for this family

3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

domain●●●●●●●●●●●●View more in app13 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

trendmicro comNews

Oct 14, 2013

PE_MOFKSYS.A - Threat Encyclopedia | Trend Micro (US)

A Windows file-infector malware that prepends its code to executable files, establishes persistence via Run/RunOnce, Winlogon Shell modification, Active Setup, and scheduled tasks, drops multiple copies of itself under masquerading filenames, provides backdoor capability for remote update/download/screen capture/keylogging/window and mouse monitoring, steals email and IM credentials plus browsing/clipboard data, and exfiltrates via its own SMTP engine.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching3

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping19

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

PE_MOFKSYS.A

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

19 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1091Replication Through Removable MediaEvidence1

It infects all .EXE files inside the folders that was accessed by the user in all physical and removable drives.

T1189Drive-by CompromiseEvidence1

arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Execution

2 techniques

T1053Scheduled Task/JobEvidence1

It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.

T1059Command and Scripting InterpreterEvidence1

Backdoor Routine This file infector executes the following commands from a remote malicious user

Persistence

4 techniques

T1053Scheduled Task/JobEvidence1

It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.

T1112Modify RegistryEvidence1

It modifies registry entries to disable the following system services... It modifies the following registry entries to hide files with Hidden attributes...

T1547.001Registry Run Keys / Startup FolderEvidence1

T1547.004Winlogon Helper DLLEvidence1

Privilege Escalation

3 techniques

T1053Scheduled Task/JobEvidence1

It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.

T1547.001Registry Run Keys / Startup FolderEvidence1

T1547.004Winlogon Helper DLLEvidence1

Stealth

3 techniques

T1036MasqueradingEvidence1

drops the following files: %Windows%\spoolsv.exe ... %Windows%\svchost.exe ... %System%\explorer.exe ...

T1497.001System ChecksEvidence1

Backdoor Routine ... Monitor window titles

T1564.001Hidden Files and DirectoriesEvidence1

It modifies the following registry entries to hide files with Hidden attributes: ... ShowSuperHidden = "0"

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

It modifies registry entries to disable the following system services... It modifies the following registry entries to hide files with Hidden attributes...

Credential Access

2 techniques

T1056.001KeyloggingEvidence1

Backdoor Routine ... Log Keystrokes

T1056.002GUI Input CaptureEvidence1

Backdoor Routine ... Monitor mouse clicks

Discovery

1 technique

T1497.001System ChecksEvidence1

Backdoor Routine ... Monitor window titles

Lateral Movement

2 techniques

T1021.002SMB/Windows Admin SharesEvidence1

It also shares the following folder in the network: %System Root%\Documents and Settings\All User\Application Data

T1091Replication Through Removable MediaEvidence1

It infects all .EXE files inside the folders that was accessed by the user in all physical and removable drives.

Collection

5 techniques

T1005Data from Local SystemEvidence1

Information Theft This file infector steals the following information: Email configurations ... Instant messenger credentials Websites visited Clipboard contents

T1056.001KeyloggingEvidence1

Backdoor Routine ... Log Keystrokes

T1056.002GUI Input CaptureEvidence1

Backdoor Routine ... Monitor mouse clicks

T1113Screen CaptureEvidence1

Backdoor Routine ... Capture screen

T1115Clipboard DataEvidence1

Information Theft This file infector steals the following information: ... Clipboard contents

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

It connects to the following URL(s) to send and receive commands from a remote malicious user

T1105Ingress Tool TransferEvidence1

Backdoor Routine ... Download other files

Exfiltration

1 technique

T1048Exfiltration Over Alternative ProtocolEvidence1

uses its own SMTP engine to send the stolen data using the following domain server: {BLOCKED}1@gmail.com ...

INDICATORS OF COMPROMISE

IOCs tracked for this family

3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

domain●●●●●●●●●●●●View more in app13 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

trendmicro comNews

Oct 14, 2013

PE_MOFKSYS.A - Threat Encyclopedia | Trend Micro (US)

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching3

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping19

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.