Loading story…
Trend Micro documented PE_MOFKSYS.A as a Windows file-infector that also operates as a backdoor, spreading through dropped payloads and malicious websites while copying itself under deceptive names including explorer.exe, svchost.exe, spoolsv.exe, mrsys.exe, and stsys.exe. The malware establishes persistence through scheduled tasks and multiple Windows Registry autostart locations, including Winlogon and Run keys, and it also disables the SharedAccess service and changes settings to hide hidden files.
Once active, PE_MOFKSYS.A can receive updates from remote operators, download additional files, capture screenshots, log keystrokes, monitor mouse clicks and active window titles, and communicate with command-and-control infrastructure hosted on domains such as t35.com, atspace.com, and zxq.net. It also steals email configuration data, instant messenger credentials, browsing history, and clipboard contents, exfiltrates data through its own SMTP engine using Gmail accounts, infects .EXE files across local and removable drives, and exposes an All Users Application Data folder over the network, increasing both persistence and lateral exposure.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro documents PE_MOFKSYS.A as a Windows file-infector and backdoor that spreads via dropped files or malicious websites, persists through scheduled tasks and registry changes, infects .EXE files, steals credentials and user data, and communicates with command-and-control domains and Gmail accounts for exfiltration. The entry also includes remediation guidance for removing dropped files and reversing persistence changes.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **KBOT** is an active Windows file-infector that spreads by injecting polymorphic malicious code into `EXE` and `DLL` files on local disks, removable media, and network shares, giving it worm-like propagation across infected environments. Once launched, the malware establishes persistence through Startup registry entries and Task Scheduler, uses DLL hijacking and process injection to embed itself in system and browser processes, and communicates with command-and-control infrastructure over encrypted channels. The malware also deploys web injects to steal banking and personal data, downloads additional stealer modules, and stores components and exfiltrated information in encrypted virtual storage. Researchers said KBOT goes beyond credential theft by modifying Remote Desktop settings to permit multiple concurrent sessions and creating a user account for remote access, combining **file infection, financial theft, stealthy persistence, and attacker-controlled administration** in a single threat.
Aug 14, 2026
Researchers reported that **Win64/Expiro.A** can infect both 32-bit and 64-bit Windows executables, allowing the malware to spread widely across local disks, removable media, and network drives. The file infector can repeatedly re-establish itself from any remaining tainted executable, complicating cleanup and increasing the risk of enterprise-wide reinfection. Beyond file infection, the malware steals credentials and sensitive data from **Internet Explorer**, **Microsoft Outlook**, **FileZilla**, and Windows certificate stores, while also manipulating browsers by installing malicious extensions for **Google Chrome** and **Mozilla Firefox**. It can intercept web form data tied to banking and payment activity, disable protections including **Windows Defender** and **Security Center**, terminate security-related processes, and provide botnet functions such as remote command execution, plugin loading, proxying, port forwarding, and **TCP flood** attacks.
Aug 15, 2026
**EvilExtractor** was observed in phishing campaigns as a Windows-focused info stealer that collects browser cookies, history, cached passwords, system details, Wi-Fi data, screenshots, selected files, keystrokes, and webcam captures from infected hosts. Researchers found the malware packaged in PyInstaller-based Python code or delivered through a .NET loader, with anti-analysis features including anti-VM, anti-sandbox, hostname checks, and date-based execution controls. Fortinet also reported that the malware family includes a ransomware component, **Kodex Ransomware**, which uses `7za.exe` to create password-protected archives before dropping a ransom note. Network analysis showed EvilExtractor operating autonomously after execution: it first checked the victim’s public IP, downloaded an additional archive named `KK2023.zip` from `193.42.33.232`, and then connected to an attacker-controlled FTP server at `89.116.53.55` using hardcoded credentials to upload stolen data while preserving the victim’s directory structure. Additional modules, including `Confirm.zip` and `MnMs.zip`, were later retrieved to enable keylogging and webcam capture, and one observed execution also exfiltrated the malware archive itself from the victim desktop. Researchers said most observed victims were in Europe and the Americas and published related IOCs including infrastructure details and file hashes.
Aug 15, 2026