Overview

overview

10

Static

static

10

2025-03-30...ch.exe

windows7-x64

10

2025-03-30...ch.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/03/2025, 18:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-30_c73ad4e507131463130b35e0d2aa41e4_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe

  • Size

    4.1MB

  • MD5

    c73ad4e507131463130b35e0d2aa41e4

  • SHA1

    24dce1b0cd79957dbddc2a104857c4e2f4c64553

  • SHA256

    988fae61be24134b60c56c6e7bb88b431e990fe170f70e5fa7f923d0c2468321

  • SHA512

    deba34251a0441e58ba14e64e01bb6febe5c1e653cfa9982b92a53508e106391e6ae6c135a10e76ee38a5a2da6434188b9ef1bc8f0ce85a1b7561c281fef5e82

  • SSDEEP

    49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4Z:ieF+iIAEl1JPz212IhzL+Bzz3dw/Vf

Score
10/10
gofingcredential_accessdiscoveryransomwarespywarestealer

Malware Config

Signatures

  • Gofing

    Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

    ransomwaregofing
  • Gofing family
    gofing
  • Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 3 IoCs
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 1 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops Chrome extension 1 IoCs
  • Drops desktop.ini file(s) 64 IoCs
  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-30_c73ad4e507131463130b35e0d2aa41e4_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-30_c73ad4e507131463130b35e0d2aa41e4_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe"
    1⤵
    • Drops startup file
    • Drops Chrome extension
    • Drops desktop.ini file(s)
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Drops file in Windows directory
    PID:3300

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\7z.dll
    Filesize

    5.9MB

    MD5

    cde3cb00993387563f2668fe073bc7c8

    SHA1

    9e7fab1b8db645012a446d7601d82e823fa047d0

    SHA256

    57024b97cb1d354a10ace63cdbdbb0f288b14ef94d924287cafad171abda4d5f

    SHA512

    4a9e175fd69dae3c1ab0805cb9998c002e1c30b92c5da2eac6031549ef75029fb0a63e360da643747d35cc8b38bd1681f76c4c672da126ebe930fbc021fe1018

    Download Submit

  • C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
    Filesize

    4.4MB

    MD5

    23e23b5945b63ba01fd5fbbcf61be3e7

    SHA1

    1bebcd83387e71dac8366e4d90c2cab0120cdef0

    SHA256

    a3ea48e4e4d406f75abeabe7a263c433ad1cd2cc6b60139ec946cda930302ceb

    SHA512

    2379f54b0ff98cfdb90f1eaa6e9de50c94856a8690c8191e9482a1613b20663b3a15ffcdd74386d00bc2b825b5cd65ca4fab4fb1ce57100258aeac8265171a08

    Download Submit

  • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
    Filesize

    5.8MB

    MD5

    f77635cc9b7f4d13a77a2d2249372074

    SHA1

    90477f31944d66e32cf22c324950239baa1a56dc

    SHA256

    f9759f1e8efad198f332a290cf656bca03f0e526278651d3158311e31bbb295b

    SHA512

    8f84332d7d4cbec76f03b180018e037c8461027e25358792bed8e38a9d71d098bfcb4a8947c40f6b99c6481ec86c5f2dbff657461165758d200d236977a8ed38

    Download Submit