Overview

overview

10

Static

static

10

2025-04-03...ch.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250313-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/04/2025, 13:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-03_ed01d819a6dd7f6e517cf78560b6df8a_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe

  • Size

    4.1MB

  • MD5

    ed01d819a6dd7f6e517cf78560b6df8a

  • SHA1

    d2843380334f207281c7f438e6f2a92957eb09fa

  • SHA256

    9cbb50fe1f5a8feed65614a98a1d0834429499bf00a546a4df0680a9f44b9072

  • SHA512

    03d4c2a506e0f5e06de453a205da9feb9dd75b2cc82030289245c9eaea18a711f1daf8b6ced8d249790bd731be4f7a96f7f86c83dfe56d7b15a9e09fda0694f9

  • SSDEEP

    49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q46:ieF+iIAEl1JPz212IhzL+Bzz3dw/V4

Score
10/10
gofingcredential_accessdiscoveryransomwarespywarestealer

Malware Config

Signatures

  • Gofing

    Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

    ransomwaregofing
  • Gofing family
    gofing
  • Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 3 IoCs
  • Renames multiple (51) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Drops file in Drivers directory 22 IoCs
  • Manipulates Digital Signatures 2 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 1 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops Chrome extension 1 IoCs
  • Drops desktop.ini file(s) 64 IoCs
  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-03_ed01d819a6dd7f6e517cf78560b6df8a_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-03_ed01d819a6dd7f6e517cf78560b6df8a_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe"
    1⤵
    • Drops file in Drivers directory
    • Manipulates Digital Signatures
    • Drops startup file
    • Drops Chrome extension
    • Drops desktop.ini file(s)
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    PID:6104

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\7-zip32.dll
    Filesize

    4.2MB

    MD5

    b06d753268e6444ef4f76b64608c4b5e

    SHA1

    a8c8bf2e746275ce26824b3af74dbec24665d6cb

    SHA256

    24bcb94b618695f4f07899e166ec83454a1db08eb1b63a6e2f8df0bc0a0fe628

    SHA512

    2e6b191815badbc689a6c0904aca724e4e1aeb3c4bcf20d6cb5aa73547bbb50c686869d4703e68b8f150cb1ffc62cf32820312ef86400da74c28eea2f32e4002

    Download Submit

  • C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
    Filesize

    4.4MB

    MD5

    5bd8837d309efa2f4a4efae27690e790

    SHA1

    7e99b338533851af854a16dda38afb0c1690a23e

    SHA256

    a8d97632986274e1964afc8d729e3ee577697865242e758439173643bbf57176

    SHA512

    182828bb36a2fb065c04d0f431c223ff56bb946802b0fd028e2f1fe9b9a1888f3715bc9d73b9674c3a1d265e50577e1002c4472d1ae44c70011b064ca1d0608c

    Download Submit

  • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
    Filesize

    5.8MB

    MD5

    6ac322357652fe9edecd8e018c113517

    SHA1

    0d0cabdc376a3f9473d867fbdb8f1dae82a399ee

    SHA256

    d703eb9c4cb15da7489a25c6f748775259fcd452915f2f2618e07051c1e78d9f

    SHA512

    22e0f673fd2ac1456bbcbc0a5c6f919095f8bfba5796af3682ed274805a47389ffd05b2ac061b9039521d9a97eff913f0d315ee9bbca6925a379ebb6bc9357e9

    Download Submit