Overview

overview

10

Static

static

10

2025-04-03...ch.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/04/2025, 17:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-03_7477e480ab16c163289a487a36446532_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe

  • Size

    4.2MB

  • MD5

    7477e480ab16c163289a487a36446532

  • SHA1

    83809eac6d35e05732a9b7b958f48e1052889eef

  • SHA256

    52e2f3d9cb990fc535a403f35218c75cd80216d17c6aa63b4522ebc0a81a20ec

  • SHA512

    c29cfa9592b019c3c3abd5872b8afe5684cfb3f633c2352fbabef9272a536a9072644e7a2e7b5823e189d94005994e916e2464c67ba695ea3d42261aa1dde6e4

  • SSDEEP

    49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4V:ieF+iIAEl1JPz212IhzL+Bzz3dw/VX

Score
10/10
gofingcredential_accessdiscoveryransomwarespywarestealer

Malware Config

Signatures

  • Gofing

    Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

    ransomwaregofing
  • Gofing family
    gofing
  • Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 2 IoCs
  • Drops file in Drivers directory 22 IoCs
  • Manipulates Digital Signatures 2 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 1 IoCs
  • Loads dropped DLL 12 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops Chrome extension 1 IoCs
  • Drops desktop.ini file(s) 64 IoCs
  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-03_7477e480ab16c163289a487a36446532_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-03_7477e480ab16c163289a487a36446532_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe"
    1⤵
    • Drops file in Drivers directory
    • Manipulates Digital Signatures
    • Drops startup file
    • Drops Chrome extension
    • Drops desktop.ini file(s)
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    PID:2908

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\7z.dll
    Filesize

    5.9MB

    MD5

    5f681c83e918ca0d8cb0c8d23a6a02ae

    SHA1

    09349ae244414b13c4dfb497aca8484b88288921

    SHA256

    ff2f69ead313a37e01fe9fd3c1316c5cfd5b3e47de9ec9cef1c531f48d65fc7a

    SHA512

    65875f268f16b089ea3cc927425f49203b6bd6ab46269555f2220ccfd95072c8cd524755da5009df7c3e548397b00a242be98b91001f281b31829797306037f9

    Download Submit

  • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
    Filesize

    5.8MB

    MD5

    6fd2e7ef8092ee938034e0efd097d486

    SHA1

    7616f8b4413618cfd649183aeeaa1994cce3672b

    SHA256

    96e99b7a18284dc13a788423b19dcc275d801d13e819d328e4d7898f8388c814

    SHA512

    6cd6644aa737e81921e8584a0b32c46a1a062dbdd9cf0e6cdeba4bb44463c729e7fed959cb61dad0449ac2966d50bc7d71fa94c638935747e8030089fe3f8b73

    Download Submit