{
  "family": "mogoogwi",
  "sample_count": 66,
  "category": "worm",
  "description": "Mogoogwi (cataloged across antivirus vendors under signatures including Worm:Win32/Mogoogwi, Worm:Win32/Mogoogwi.A, and Trojan:MSIL/Mogoogwi.A) is an aggressive Windows worm and trojan active since 2015. Known for propagating rapidly across local networks and removable USB storage devices, Mogoogwi copies itself to the root of connected flash drives, disguises its binaries within hidden directories, and generates deceptive .lnk shortcut files mimicking folders (such as fake 'Google Chrome' or 'Downloads' folders) to induce user execution. Once active on an endpoint, Mogoogwi modifies the Windows Firewall policy, establishes persistent autostart keys under CurrentVersion\\Run, and queries host system configurations. It communicates with remote command-and-control servers to download secondary malicious components, including information stealers and cryptocurrency miners.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Worm:Win32/Mogoogwi",
    "Worm:Win32/Mogoogwi.A",
    "Trojan:MSIL/Mogoogwi.A",
    "Win32/Mogoogwi"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Worm:Win32/Mogoogwi?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Mogoogwi is a Windows worm and trojan that spreads via USB drives and downloads secondary malware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Mogoogwi propagate across USB flash drives?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It copies hidden executables to the drive root and creates deceptive shortcut files disguised as folders."
      }
    },
    {
      "@type": "Question",
      "name": "What system changes are made by Mogoogwi upon infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It alters Windows Firewall settings, adds registry autostart keys, and profiles host hardware."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary malware is dropped by Mogoogwi?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It frequently downloads cryptocurrency miners, adware inject modules, and credential stealers."
      }
    },
    {
      "@type": "Question",
      "name": "How do administrators disinfect systems from Mogoogwi?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Clean infected USB media, run an offline antimalware scan, reset firewall rules, and delete startup keys."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1091",
    "T1547.001",
    "T1562.004",
    "T1105",
    "T1059.003",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the active exfiltration of browsing telemetry and the downloading of further adware modules.",
    "Audit Windows Group Policies and the Registry to remove any forced extension installation policies (ExtensionInstallForcelist) created by the adware.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to locate and strip the deeply embedded registry hooks and watchdog services.",
    "Force a complete reset of all installed web browsers to factory defaults to eradicate the rogue extensions and restore the homepage."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's 'remove extension' button; Mogoogwi frequently uses GPOs and watchdog services to immediately reinstall itself.",
    "Avoid ignoring the infection; adware tracking data is highly detailed and may expose corporate activities or access to internal portals."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Network Propagation & Secondary Payload Staging",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2015,
  "threat_actor": null,
  "delivery_mechanism": [
    "Removable USB Media (LNK Shortcut Hijacking)",
    "Local Network File Shares",
    "Bundled Software Downloads"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "USB Removable Drive Propagation",
    "Windows Firewall Modification",
    "Secondary Payload Downloading",
    "Host System Reconnaissance",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "LNK Shortcut",
      ".NET Framework Assembly"
    ],
    "network_signatures": [
      "HTTP GET requests beaconing host specifications to remote C2 IP endpoints",
      "Outbound downloads fetching secondary executable payloads"
    ],
    "evasion_techniques": [
      "Hiding malicious binaries on removable drives with system/hidden attributes",
      "Masquerading as legitimate software folders like Google Chrome"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Mogoogwi",
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SystemTrayHost"
    ]
  },
  "impact": {
    "confidentiality": "Medium",
    "integrity": "High",
    "availability": "Medium",
    "scope": "USB drive contamination, modified firewall security posture, secondary threat staging"
  },
  "lineage": {
    "derived_from": [
      "Win32 USB Autorun Worm Architectures"
    ],
    "variants": [
      "Mogoogwi.A",
      "Mogoogwi.MSIL"
    ]
  },
  "iocs": {
    "file_hashes": [
      "3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a",
      "4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b"
    ],
    "delivery": [
      "usb_driver.exe",
      "chrome_setup.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\MogoogwiService",
      "%AppData%\\Mogoogwi\\mogoogwi.exe"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Worm:Win32/Mogoogwi.A",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Mogoogwi.A"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Worm.Win32.Mogoogwi",
      "url": "https://www.trendmicro.com"
    }
  ]
}