Categories: Worm

About “Worm:Win32/Mofksys.NA!MTB” infection

The Worm:Win32/Mofksys.NA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm:Win32/Mofksys.NA!MTB virus can do?

Behavioural detection: Executable code extraction – unpacking
Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
Sample contains Overlay data
Reads data out of its own binary image
CAPE extracted potentially suspicious content
Drops a binary and executes it
Executes the printer spooler process
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Deletes executed files from disk
Attempts to disable UAC
Attempts to modify UAC prompt behavior
Modifies Image File Execution Options, indicative of process injection or persistence
Attempts to modify Explorer settings to prevent hidden files from being displayed
Uses suspicious command line tools or Windows utilities

How to determine Worm:Win32/Mofksys.NA!MTB?


File Info:
name: 976CF0AC14896348C56E.mlwpath: /opt/CAPEv2/storage/binaries/c17c354bdad1b7283948a71a5a15107cf6ba8dfa60ad4d9c58c12c3d94e3af9acrc32: A6C0AB08md5: 976cf0ac14896348c56eaeb0e27131ddsha1: 19890625d2b726331d9e89f61863b0dfa01c0fb6sha256: c17c354bdad1b7283948a71a5a15107cf6ba8dfa60ad4d9c58c12c3d94e3af9asha512: f6afa27294a58cd014422baf890f1b101f200e0e06b79cf00447d9f5448c2cd3627b385020d57d09f47f489f2fa67578a4e861213c94bb373b721f1041b331b1ssdeep: 49152:d77vkMZfAhZfBGSYtOIgXYoHuDuvGuJTlrJ3ei8llv4cqeNVYE7hIZznA2CyGvez:d7bmZBHuavHH8eESE7hIHUMpJhhI6YXytype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1D0369D27B394653EC47F1A364933A3589D7BB6612A168C5B97F0088CCF3A5802F7E647sha3_384: 76ed1000c06189c2dd54aed327b2f861a580b34b81009058991af1ca43b3b052fccd721d325f78b8bd5bb1ee702ff682ep_bytes: 558bec83c4f0b8b4cc6800e81c85d7fftimestamp: 2020-12-01 07:47:29
Version Info:
FileVersion: 1.0.0.0ProductVersion: 1.0.0.0Translation: 0x0409 0x04e4

Worm:Win32/Mofksys.NA!MTB also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Ransom.Telecrypt.2
McAfee	GenericRXAA-AA!976CF0AC1489
Cylance	unsafe
VIPRE	Gen:Variant.Ransom.Telecrypt.2
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Trojan ( 00524acd1 )
K7GW	Trojan ( 00524acd1 )
Cybereason	malicious.c14896
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Bancteian.B
APEX	Malicious
Kaspersky	HEUR:Trojan.Win32.Agent.gen
BitDefender	Gen:Variant.Ransom.Telecrypt.2
Avast	Win32:Malware-gen
Tencent	Malware.Win32.Gencirc.10bb428c
Emsisoft	Gen:Variant.Ransom.Telecrypt.2 (B)
F-Secure	Heuristic.HEUR/AGEN.1220429
DrWeb	Trojan.MulDrop15.62387
Zillya	Trojan.Bancteian.Win32.60
McAfee-GW-Edition	BehavesLike.Win32.Generic.rh
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.976cf0ac14896348
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI – Suspicious PE
GData	Gen:Variant.Ransom.Telecrypt.2
Jiangmin	Trojan.Agent.dacz
Google	Detected
Avira	HEUR/AGEN.1220429
Antiy-AVL	Trojan/Win32.Bancteian
Arcabit	Trojan.Ransom.Telecrypt.2
Microsoft	Worm:Win32/Mofksys.NA!MTB
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win.Generic.R436476
VBA32	TScope.Trojan.Delf
ALYac	Gen:Variant.Ransom.Telecrypt.2
MAX	malware (ai score=85)
Malwarebytes	Malware.AI.4291123851
Rising	Stealer.Delf!8.415 (TFE:4:45p18v5R0NU)
Yandex	Trojan.Agent!fQmMuiwWw6Y
Ikarus	Trojan.Win32.Bancteian
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Agent.CC3A!tr
BitDefenderTheta	AI:Packer.8405B2201E
AVG	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_90% (D)