Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
02/05/2025, 10:07
Behavioral task
behavioral1
Sample
2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe
Resource
win10v2004-20250314-en
General
-
Target
2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe
-
Size
5.9MB
-
MD5
5d951c92968ca21da3bf552e5841d5f2
-
SHA1
d6090761782d0597eb2e0b139e5211aead020d03
-
SHA256
78b0a0f2ba9434a0c5fbadf2026f7f354f1b1a78992c8187963f6689d3817c02
-
SHA512
b29c340aa00e3a2fa394f87229586404a1051186ff403d0ba79ab7e7cfc358b0f64637ac524f019dea7d48321a9f8db5d5eed4ab0260454473bf9db7ee008852
-
SSDEEP
98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/Vw0lHPuo3lO55Ga8KM:pWvSDzaxztQVwWHmo3lO5oa8D
Malware Config
Signatures
-
Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
-
Gofing family
-
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 3 IoCs
resource yara_rule behavioral1/files/0x0003000000022a39-4.dat family_gofing behavioral1/files/0x0002000000021da7-5424.dat family_gofing behavioral1/files/0x0002000000022289-5436.dat family_gofing -
Renames multiple (52) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Loads dropped DLL 64 IoCs
pid Process 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found 3520 Process not Found -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File created C:\Program Files (x86)\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\3D Objects\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Favorites\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Searches\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Media\Desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Music\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Favorites\Links\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Downloaded Program Files\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\$Recycle.Bin\S-1-5-21-3975168204-1612096350-4002976354-1000\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\OneDrive\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Desktop\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Documents\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Libraries\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Music\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Desktop\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Offline Web Pages\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Pictures\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Contacts\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Documents\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Videos\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Downloads\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\AppVTerminator.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\CapabilityAccessManagerClient.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ARP.EXE 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\AcGenral.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\AcWinRT.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\AppInstallerPrompt.Desktop.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ClipboardServer.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Configuration\BaseRegistration\uk-UA\MSFT_MetaConfigurationExtensionClasses.Schema.mfl 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\AppointmentActivation.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\BamSettingsClient.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\BrowserSettingSync.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\CallHistoryClient.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Configuration\BaseRegistration\BaseResource.Schema.mof 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\C_ISCII.DLL 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Configuration\BaseRegistration\es-ES\BaseResource.Schema.mfl 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\MSFT_FileDirectoryConfiguration.Registration.mof 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\de-DE\MSFT_FileDirectoryConfiguration.Schema.mfl 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\uk-UA\MSFT_FileDirectoryConfiguration.Schema.mfl 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ConfigureExpandedStorage.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ChatApis.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Clipc.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\@AppHelpToast.png 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\AboveLockAppHost.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\AppIdPolicyEngineApi.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\C_IS2022.DLL 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Configuration\BaseRegistration\MSFT_DSCMetaConfiguration.mof 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\AcLayers.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\AuthBrokerUI.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\BcastDVRBroker.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Configuration\BaseRegistration\de-DE\MSFT_DSCMetaConfiguration.mfl 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Configuration\BaseRegistration\it-IT\BaseResource.Schema.mfl 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\es-ES\MSFT_FileDirectoryConfiguration.Registration.mfl 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\AuthBroker.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\AuthFWGP.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\AzSqlExt.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Com\de-DE\comrepl.exe.mui 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\CompPkgSup.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Configuration\BaseRegistration\en-US\MSFT_DSCMetaConfiguration.mfl 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\it-IT\MSFT_FileDirectoryConfiguration.Schema.mfl 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\CertEnrollUI.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\12520850.cpx 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\AarSvc.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\AdmTmpl.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\AudioSes.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\AuthExt.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Com\comempty.dat 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\fr-FR\MSFT_FileDirectoryConfiguration.Schema.mfl 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ActionCenter.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\AssignedAccessRuntime.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\BitsProxy.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\CPFilters.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ComposableShellProxyStub.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Configuration\BaseRegistration\es-ES\MSFT_DSCMetaConfiguration.mfl 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\@WirelessDisplayToast.png 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\APHostClient.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\BcastDVRClient.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\BingMaps.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\CallButtons.ProxyStub.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Configuration\BaseRegistration\MSFT_MetaConfigurationExtensionClasses.Schema.mof 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Configuration\BaseRegistration\en-US\MSFT_MetaConfigurationExtensionClasses.Schema.mfl 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Configuration\BaseRegistration\fr-FR\MSFT_DSCMetaConfiguration.mfl 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\AppResolver.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\dxil.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Sockets.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationBuildTasks.resources.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\vlc.mo 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\PSGet.Resource.psd1 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-150_contrast-black.png 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SuperSlowMotionCheckbox.xbf 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\W6.png 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_contrast-white.png 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\SmallTile.scale-200.png 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailLargeTile.scale-150.png 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Common Files\System\msadc\de-DE\msadcor.dll.mui 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_patterns_header.png 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmmui.msi.16.en-us.xml 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\SplashScreen.scale-125.png 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\stickers\word_art\sticker17.png 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.Editors.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-cn\ui-strings.js 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\selector.js 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\share_icons2x.png 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Microsoft.Office.Interop.Excel.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GameBar_LargeTile.scale-100.png 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\welcome.png 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\SaveAsRTF.api 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\es-ES\PackageManagementDscUtilities.strings.psd1 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\FileSystemMetadata.xml 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\16.png 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_TileWide.scale-200.png 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\ui-strings.js 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Locales\mi.pak 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Windows Media Player\uk-UA\mpvis.dll.mui 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-400_contrast-black.png 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-256_altform-lightunplated.png 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\resources.pri 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.NonGeneric.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\TextIntelligence.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\AppxManifest.xml 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24.png 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\UnblockPop.xls 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libposterize_plugin.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\mk.pak 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\MSFT_PackageManagementSource.strings.psd1 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\Microsoft.PackageManagement.resources.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\office.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\smsconnect\torch1x.png 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\Retail\guest.png 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-ae\ui-strings.js 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\css\main.css 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Fonts\BroMDL2.2.33.ttf 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageWideTile.scale-150.png 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\LargeTile.scale-100.png 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\resources.pri 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ppd.xrm-ms 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Security.Principal.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\SMDiagnostics.resources.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Activities.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\System.IdentityModel.Selectors.resources.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\System.Runtime.Serialization.Formatters.Soap.resources.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.resources.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PLA\Rules\Rules.System.Configuration.xml 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PLA\Rules\ja-JP\Rules.System.Common.xml 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\LanmanWorkstation.admx 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\en-US\PerformancePerftrack.adml 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\ja-JP\Printing2.adml 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Speech\Engines\SR\de-DE\l1031.ngr 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Installer\35dc.msi 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorpe.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\de\System.DirectoryServices.Protocols.resources.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\normnfkc.nlp 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\v4.0_10.0.0.0_es_b03f5f7f11d50a3a\Microsoft.VisualBasic.resources.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_perf2.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Xml.XPath.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\System.Data.Services.Client.resources.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\webengine.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\es\Microsoft.VisualBasic.Compatibility.resources.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Speech\Engines\SR\en-US\l1033.dlm 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Cursors\size2_il.cur 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\.NET Memory Cache 4.0\netmemorycache.ini 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state_perf.h 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallRoles.sql 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PenIMC_v0400.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\it\ReachFramework.resources.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\migration.dat 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-black_scale-125.png 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\EditAppSetting.aspx.es.resx 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Providers\App_LocalResources\manageProviders.aspx.es.resx 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\es\XsdBuildTask.resources.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\Microsoft.GroupPolicy.AdmTmplEditor.Resources.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Utility.Activities.Resources\v4.0_3.0.0.0_fr_31bf3856ad364e35\Microsoft.PowerShell.Utility.Activities.Resources.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\DebugAndTrace.aspx.resx 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\fr\Microsoft.Data.Entity.Build.Tasks.Resources.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\aspnet.mfl 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\es\System.Data.resources.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-white_scale-125.png 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ES\System.Web.Mobile.resources.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.Protocols.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\es\PresentationBuildTasks.resources.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions.resources\v4.0_4.0.0.0_fr_b77a5c561934e089\System.Data.DataSetExtensions.resources.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\fr-FR\Passport.adml 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\microsoft_bluetooth_a2dp.inf 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ImmersiveControlPanel\images\TileSmall.scale-100.png 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\System.WorkflowServices.resources.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\es\ComSvcConfig.resources.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ShellExperiences\JumpViewUI.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\mdmnttd2.inf 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Media\Ring07.wav 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\System.Data.DataSetExtensions.resources.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorpehost.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClientsideProviders.resources\v4.0_4.0.0.0_es_31bf3856ad364e35\UIAutomationClientsideProviders.resources.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\it-IT\DeviceCredential.adml 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Provisioning\Packages\Power.Settings.Sleep.ppkg 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CertificateServices.PKIClient.Cmdlets.Resources\v4.0_10.0.0.0_en_31bf3856ad364e35\Microsoft.CertificateServices.PKIClient.Cmdlets.Resources.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\it-IT\ControlPanelDisplay.adml 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\ssef1256.fon 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\fr\Microsoft.Build.Tasks.resources.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\1041\Microsoft.VisualBasic.Activities.CompilerUI.dll 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\es\DropSqlPersistenceProviderLogic.sql 2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2025-05-02_5d951c92968ca21da3bf552e5841d5f2_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe"1⤵
- Drops startup file
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:6072
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD56ef6a3830a6729ab9f620785a843e49f
SHA154f39a1d0dc32b6eaaaa6f931f7f9bbcf3e06c06
SHA25666dc93daca350cf4381a473c4e31a3dd4df515766205ad9cebe461e4e12e58c4
SHA5126ebeeb7b6bd69ac6867695c002e0b8245d0bec55934947905d53958d2aace48f3d16e0aaa1d69457b5a1ddeec6d301981bc9bdd1b24196fca6e7108e512fa2b8
-
Filesize
4.4MB
MD5587f2836341f341971b2ed6fce765eaa
SHA1d3a9d2a8d9f2e506640547ebee254269c2685148
SHA25681ab89211535fa83d0a478311c2fc4f430936aff3456d9b66ee5344865834274
SHA51210a623ffaa51f929fb1f69229a99630ae1845152cd08b810bbcf6c6b0866f91235a3e9d749bb8bca5811e5ca04ceedb05d15c43054af33ec2c7925df8dbb601f
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
Filesize5.8MB
MD52b5fe291adec8a3e4b22d8e88c0a1c5f
SHA1968b6a02d93345cc7d329701203f688dcb45dae6
SHA25662786e48db8e2b8c44ca778eeced3c331797e26f48072b0ca7a6c8e0ef31ea9c
SHA512e6ddde91e078a71b842f73f3cd95b693db7d4a4bdf3901e48781d129a21af68e13c5789c1a9f94a407630eda10e8095b07d0bafa3ed21a427ccb05545f416380