Mofksys

Overview

Worm:Win32/Mofksys is a malicious computer worm designed to spread rapidly across networks, via removable USB drives, and through malicious email attachments. Targeting Microsoft Windows systems, Mofksys acts as both a self-propagating threat and a backdoor for attackers.

Understanding Mofksys
Unlike simple viruses, worms like Mofksys are designed to move laterally without user intervention once initial access is gained on a network. Mofksys is often used as a precursor to more severe attacks, as it establishes a foothold that can be leveraged to drop secondary payloads.

Execution and Propagation
Upon execution, Mofksys immediately attempts to establish persistence by modifying Windows registry Run keys (`T1547.001`), ensuring it starts automatically when the system boots. It then begins scanning the local network for vulnerable shares (`T1021.002`) and copies itself to any connected removable media (`T1091`). Mofksys frequently exhibits data theft capabilities, collecting sensitive system information and user credentials, which it transmits to an attacker-controlled server via SMTP or HTTP (`T1048`). Furthermore, it opens a backdoor on the infected system, allowing remote attackers to execute arbitrary commands, log keystrokes, and download additional, more destructive payloads.

Indicators of Compromise (IoCs)
Defenders should look for unexpected outbound SMTP or HTTP traffic originating from anomalous processes. The creation of unauthorized executable files on network shares or removable drives is a strong indicator of worm activity. Look for suspicious registry modifications in `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run` designed to execute unknown binaries.

Known aliases

Threat reports may refer to this family under multiple names:

• Worm:Win32/Mofksys
• Virus:Win32/Mofksys
• Worm:Win32/Mofksys.A
• Virus:Win32/Mofksys.B

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_MOFKSYS {
    meta:
        description = "Detects Mofksys (worm)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "mofksys" ascii wide nocase
        $s2 = "worm:win32/mofksys" ascii wide nocase
        $s3 = "virus:win32/mofksys" ascii wide nocase
        $s4 = "worm:win32/mofksys.a" ascii wide nocase
        $s5 = "virus:win32/mofksys.b" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Mofksys Activity
id: 9d75437d737b19092e14fcdf138d63c4
status: experimental
description: Detects generic indicators of the mofksys malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*mofksys*"
            - "*worm:win32/mofksys*"
            - "*virus:win32/mofksys*"
            - "*worm:win32/mofksys.a*"
            - "*virus:win32/mofksys.b*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Disconnect the infected machine from the local network and internet immediately to halt the worm's lateral movement and data exfiltration.
2. Disable AutoRun/AutoPlay across the organization to prevent the worm from executing via infected USB drives.
3. Perform a full system scan with an updated enterprise antivirus solution, booting into Safe Mode if necessary to bypass active rootkits.
4. Change all user credentials and administrative passwords that were stored or used on the infected system, as they may have been compromised.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not connect any USB drives or external storage to the infected system until it has been completely sanitized.
2. Do not assume only one machine is infected; worms spread rapidly, so you must sweep the entire network for IoCs.

References & External Analysis

• Search "mofksys" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: worm)

Explore other malware families in the same category:

• Mira
• Vobfus
• Pykspa
• Conficker
• Chir

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/mofksys.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.