Overview

overview

10

Static

static

10

2025-04-04...ch.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/04/2025, 05:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-04_d4a3101243ed265ff9bcf8553aa8be11_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe

  • Size

    4.2MB

  • MD5

    d4a3101243ed265ff9bcf8553aa8be11

  • SHA1

    e0e78952b40c3802d9b9efeec6a6a9d65383e5f5

  • SHA256

    15117b6b0edb35d5ace0ec0befd71e3fec99e6c44ce7b500a5f20f376692fb53

  • SHA512

    adbb5afa3b80d80756057c7b79ca440bf93751e69bd62410d7d36c29d502ec465c98b5e43d2e6b3b763d7be1d9801992018cea10f2de317f2a2f61eb33db3d49

  • SSDEEP

    49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q46:ieF+iIAEl1JPz212IhzL+Bzz3dw/Vc

Score
10/10
gofingcredential_accessdiscoveryransomwarespywarestealer

Malware Config

Signatures

  • Gofing

    Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

    ransomwaregofing
  • Gofing family
    gofing
  • Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 3 IoCs
  • Renames multiple (52) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Drops file in Drivers directory 22 IoCs
  • Manipulates Digital Signatures 2 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 1 IoCs
  • Loads dropped DLL 48 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops Chrome extension 1 IoCs
  • Drops desktop.ini file(s) 64 IoCs
  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-04_d4a3101243ed265ff9bcf8553aa8be11_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-04_d4a3101243ed265ff9bcf8553aa8be11_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe"
    1⤵
    • Drops file in Drivers directory
    • Manipulates Digital Signatures
    • Drops startup file
    • Drops Chrome extension
    • Drops desktop.ini file(s)
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    PID:4940

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\7-zip.dll
    Filesize

    4.2MB

    MD5

    997d78be35a9d2545bd11aadb337d0ed

    SHA1

    cafaca88b79c1907768738f1b888cbae633f2e02

    SHA256

    c84d171e21cbbe93044669f19510eefe26a7a0b1e56f7610e9867edb47cd6350

    SHA512

    1c563f8022b05524132cadf654dc8f1aa6a9602dd71e6a07c7e3a101abafc5430a1d69bea4e9f7c1f9bb0e6d3acfd13d8628b19f651a16c71ae8b9fc33834571

    Download Submit

  • C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
    Filesize

    4.4MB

    MD5

    9033672384b818364582fe3b6992156d

    SHA1

    7c842b6cf663455d49f0fcabcda9b9478be99aa6

    SHA256

    e2a6367533a89a31dc9b8625e9ba28331782e9153bede630abbd0f4f6c82ac8c

    SHA512

    47009aa4c91a3e6fb2fa2929cd5a3484b0405e7b4b856e9e6c7b501741a1a2a00a845d572d343d3fd80223c701bfb10d9852c90a0cb6619d8c4a7fcb04c8be52

    Download Submit

  • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
    Filesize

    5.8MB

    MD5

    da20efec20d9eb1efbaaf51dda9c4a96

    SHA1

    1bdf38805a28a0835da800edf4e68f015e2d321a

    SHA256

    2726c5a465b54ab1b5d157d01ed6c687d79e593c955abf3983deb3afbc53defd

    SHA512

    e917faea12305e8aba2f0f99bcd9df1e515ab8fc7763a563b3e45930a84161b23232e4558a9e0f9ea2fb703a0875600acc6bdbe1a03dbd404df490a663e94edd

    Download Submit