Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2025, 07:44
Behavioral task
behavioral1
Sample
2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Resource
win11-20250502-en
General
-
Target
2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
-
Size
4.1MB
-
MD5
f3ed9cd9921dfa3797fdd934bd8ac588
-
SHA1
0fa86de71b5db72945d23335ac0f2d0ed93c49dd
-
SHA256
b483a3149d98dc85a6bb102b1b7d77531a256cc92b811e8ee7aca50c99fe3d09
-
SHA512
cd7b1d6246bdaeb662400fc9bbb8563b21ce7c063f188ebb9c20c1d87baad4fc09fad3821f0246100b517909a6a41ad63e506cce355845059ae61870d7adb701
-
SSDEEP
49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4+:ieF+iIAEl1JPz212IhzL+Bzz3dw/Vc
Malware Config
Signatures
-
Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
-
Gofing family
-
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 3 IoCs
resource yara_rule behavioral1/files/0x0003000000022a35-4.dat family_gofing behavioral1/files/0x0002000000021801-5416.dat family_gofing behavioral1/files/0x00020000000217fc-5437.dat family_gofing -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Loads dropped DLL 64 IoCs
pid Process 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found 3468 Process not Found -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\OneDrive\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Favorites\Links\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Links\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Documents\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Downloads\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Downloads\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Libraries\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\$Recycle.Bin\S-1-5-21-3690492401-2005096563-3427069815-1000\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Desktop\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Media\Desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\AccountPictures\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Desktop\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Music\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Videos\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Contacts\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Favorites\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Documents\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Downloaded Program Files\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Videos\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Pictures\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\Microsoft.Windows.Firewall.Commands.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WinMetadata\Windows.Security.winmd 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\es-ES\MSFT_ProcessResource.strings.psd1 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PrintManagement\MSFT_PrinterConfiguration.types.ps1xml 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetAdapter\MSFT_NetAdapterBinding.Format.ps1xml 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PKI\pki.psd1 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PrintManagement\MSFT_PrintJob.format.ps1xml 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\F12\F12Platform2.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\RacEngn.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\ja-JP\MSFT_WaitForSome.schema.mfl 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\fr-FR\PSDesiredStateConfiguration.Resource.psd1 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\MapConfiguration.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsCodecs.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetworkTransition\MSFT_Net6to4Configuration.cdxml 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\es-ES\MSFT_GroupResource.strings.psd1 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\it-IT\MSFT_RegistryResource.schema.mfl 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\es-ES\MSFT_ScriptResource.schema.mfl 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\SettingSyncHost.exe 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Windows.Security.Integrity.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PrintManagement\MSFT_PrinterProperty.types.ps1xml 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Dism\fr-FR\LogProvider.dll.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\PCShellCommonProxyStub.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Windows.Globalization.PhoneNumberFormatting.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Windows.Networking.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsClient\DnsCmdlets.Format.ps1xml 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\it-IT\ArchiveResources.psd1 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\es-ES\MSFT_EnvironmentResource.schema.mfl 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ApiSetHost.AppExecutionAlias.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\KBDBR.DLL 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\de-DE\prnqctl.vbs 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\SrpUxNativeSnapIn.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\ja\Microsoft.Dtc.PowerShell.Resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\KBDOGHAM.DLL 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\TapiSysprep.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Windows.ApplicationModel.Background.TimeBroker.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Dism\es-ES\DmiProvider.dll.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\FXSCOMEX.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\KBDSL.DLL 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\PrintWorkflowService.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\en-US\VES-Select.0409.grxml 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\fr-FR\MSFT_ProcessResource.strings.psd1 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Unistore.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetTCPIP\MSFT_NetTCPConnection.cdxml 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCHPS.DLL 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\en-US\MSFT_FileDirectoryConfiguration.Registration.mfl 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\KBDLT1.DLL 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\TpmCoreProvisioning.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WPDShServiceObj.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Windows.Energy.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\KBDGAE.DLL 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\MsraLegacy.tlb 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Utilman.exe 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Licenses\neutral\OEM\Professional\license.rtf 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\NapiNSP.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Nui\FaceAnalysisColor.mdl 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\RADCUI.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Windows.Gaming.Preview.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\uk-UA\MSFT_GroupResource.schema.mfl 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\WindowsOptionalFeatureSet\WindowsOptionalFeatureSet.psd1 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0006\_setup.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\fr-FR\BitLocker.psd1 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetworkTransition\MSFT_NetIpHTTPsState.format.ps1xml 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Windows Media Player\es-ES\WMPMediaSharing.dll.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Microsoft.PowerShell.Operation.Validation.psm1 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ORGCHART.CHM 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\Retail\Retail_Feedback_icon.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\resources.pri 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemDrawing.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-cn\ui-strings.js 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsBase.resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-100.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-16_altform-unplated.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\VisualElements\SmallLogoDev.png.DATA 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libaes3_plugin.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Extensions.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\sendforcomments.svg 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libpanoramix_plugin.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-40.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.XDocument.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\AddIns.store 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul-oob.xrm-ms 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\VVIEWDWG.DLL 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-100_contrast-white.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Trust Protection Lists\Mu\TransparentAdvertisers 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\MSFT_PackageManagement.strings.psd1 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\vlc.mo 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-125_contrast-black.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-100_contrast-white.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\XLINTL32.DLL 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\7-Zip\Lang\es.txt 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ppd.xrm-ms 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ppd.xrm-ms 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\avatar_default_large.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FetchingMail-Dark.scale-150.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\wns_push_client.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdateres_sr-Latn-RS.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-140.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcp140.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\LargeTile.scale-125.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\WideTile.scale-100.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\trdtv2r41.xsl 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\Weather_TileWide.scale-100.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-150.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSplashLogo.scale-250.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluDCFilesEmpty_180x180.svg 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\WelcomeCardRdr-2x.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\release 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe\mrt_map.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleMedTile.scale-200.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\AppxManifest.xml 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Controls.Ribbon.resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_altform-unplated_contrast-black.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Metadata.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\ui-strings.js 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageMedTile.scale-100.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-400_contrast-white.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\INF\wvmgid.inf 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ImmersiveControlPanel\images\logo.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\avantgo.browser 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\WsatConfig.resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\navigationBar.ascx.de.resx 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Workflow.ComponentModel.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ja\System.Management.resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\it-IT\MicrosoftEdge.adml 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\85f1255.fon 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\ks.inf 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Providers\App_LocalResources\providerList.ascx.it.resx 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\Browsers\blackberry.browser 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\System.IdentityModel.resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ja\Microsoft.VisualBasic.Compatibility.resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Client.resources\v4.0_4.0.0.0_it_b77a5c561934e089\System.Data.Services.Client.resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\ja-JP\Explorer.adml 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\c_keyboard.inf 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\editUser.aspx.ja.resx 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\v4.0_10.0.0.0_en_31bf3856ad364e35\Microsoft.ApplicationId.Framework.Resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.Claims\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.Claims.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\de-DE\msched.adml 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\netax88179_178a.inf 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\DE\shfusion.chm 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\de\System.Design.resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\GlobalUserInterface.CompositeFont 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ja\System.IdentityModel.Services.resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\v4.0_2.0.0.0_ja_31bf3856ad364e35\Microsoft.GroupPolicy.Reporting.Resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\Speech.admx 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Prefetch\RUNTIMEBROKER.EXE-98C67737.pf 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\findUsers.aspx.fr.resx 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\fr\SqlPersistenceService_Schema.sql 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\home1.aspx.es.resx 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\normnfkc.nlp 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\en-US\Printing2.adml 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Speech_OneCore\Engines\TTS\en-US\NUSData\M1033Eva.voiceAssistant.WVE 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Media\flourish.mid 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardFinish.ascx 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\de\System.IdentityModel.Services.resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\DE\aspnet_compiler.resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\editUser.aspx.es.resx 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\de\DropSqlPersistenceProviderLogic.sql 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\v4.0_3.0.0.0_es_31bf3856ad364e35\Microsoft.PowerShell.Security.Resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Client.resources\v4.0_4.0.0.0_ja_b77a5c561934e089\System.Data.Services.Client.resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Providers\App_LocalResources\manageProviders.aspx.de.resx 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\addUser.aspx.it.resx 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Internals.aspx.de.resx 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\de\System.Windows.Forms.DataVisualization.resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activities.resources\v4.0_4.0.0.0_es_31bf3856ad364e35\System.ServiceModel.Activities.resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\aspnet_compiler.resources\v4.0_4.0.0.0_de_b03f5f7f11d50a3a\aspnet_compiler.resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\TextInput.admx 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Resources\Themes\aero\it-IT\aero.msstyles.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\manageUsers.aspx.resx 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\it-IT\TabletPCInputPanel.adml 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Prefetch\RUNDLL32.EXE-976DB280.pf 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Boot\EFI\zh-CN\memtest.efi.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\audioendpoint.PNF 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\input.PNF 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\System.Web.Abstractions.resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\v4.0_10.0.0.0_en_31bf3856ad364e35\Microsoft.GroupPolicy.AdmTmplEditor.Resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\DiskQuota.admx 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\calibril.ttf 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\mdmnttd6.inf 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\microsoft_bluetooth_a2dp.PNF 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\secrecs.inf 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"1⤵
- Drops startup file
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:3956
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD52a694c16a9f0795295831379543e0154
SHA1cc3dc6c88b8d0758049adbd6356e0d33ad524d68
SHA256393aaafeb5c1453cc3decf4dfe8705b3aef2d37930406349c48f0a4af7593f2a
SHA5125b5b74f21d6096b35ec3582f33e2cbfbae47bfb73f007033873325362bfba3b24b9ace620d7943956f1a44b8d4a842cc5db6cf26f317cd01944d726bc01dfa59
-
Filesize
4.4MB
MD5c70ad79b7ce60e25d0c5c75d9b141d6b
SHA1e1edb1f9a3c33634c552499f16e4e82f30387bbc
SHA2564b58c30f721db0548de93247c27bc63fa12624804d3eb97de337b9853c70963e
SHA512dd67a1c844c7ba84284c06752bca565c6e11cfb151bf655b7683e56d843d86391569c2beeb97962ff54a6570cbd26e6c9e5570f77ff6805b1463eeecaeb2b62b
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
Filesize5.8MB
MD5a8d93764571aa77d035fc43b22518eec
SHA105c0ef8eb1b93a7b3a4e436c11d623f05a05743f
SHA256d21a77b340bafa2955215828d2cdca0f403488f45c73765de36527dfc2e5288a
SHA5122a26774b831cb183f8497e5d1df93ed6fadd2ee363b063405069beb3701e1601fce42b8c86980989b674d1565eea19ebf7af2613279fd1d5fd76268134fc4f68