Malware Analysis Report

2025-06-16 06:31

Sample ID 250515-jp48msbn3x
Target 2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch
SHA256 7077ddac62ea1edf3085aa90c7b02d5f5f954dd5b80c9320d50f982c0f266434
Tags
gofing ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7077ddac62ea1edf3085aa90c7b02d5f5f954dd5b80c9320d50f982c0f266434

Threat Level: Known bad

The file 2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch was found to be: Known bad.

Malicious Activity Summary

gofing ransomware

Gofing

Gofing family

Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

Drops desktop.ini file(s)

Drops file in Program Files directory

Unsigned PE

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2025-05-15 07:51

Signatures

Gofing family

gofing

Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-05-15 07:51

Reported

2025-05-15 07:54

Platform

win10v2004-20250502-en

Max time kernel

61s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"

Signatures

Gofing

ransomware gofing

Gofing family

gofing

Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\$Recycle.Bin\S-1-5-21-3690492401-2005096563-3427069815-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmad_plugin.dll C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Standard.targetsize-20_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-36_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\GRAY.pf C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-xstate-l2-1-0.dll C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-150.png C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-60_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\_Resources\index.txt C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\OrientationControlCone.png C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\sql70.xsl C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.v11.1.dll C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\AriaWrapper.winmd C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\ProgressControl.xaml C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Mso98win32client.dll C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-24.png C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\resources.pri C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Dtmf_6_Loud.m4a C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr3jp.dll C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Windows Defender\uk-UA\ProtectionManagement.dll.mui C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\MicrosoftSolitaireMedTile.scale-200.jpg C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Light\GlowInTheDark.png C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\office.png C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Msg_Received.m4a C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe\vcruntime140_1_app.dll C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-64.png C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\amd64\jvm.cfg C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-180.png C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-96.png C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\FileAssociation\FileAssociation.targetsize-24.png C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\FaceReco_Illustration_SM.png C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\AppxManifest.xml C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeWideTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\zip.dll C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-heap-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-256_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\MEIPreload\manifest.json C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Office Theme.thmx C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\FPSRVUTL.DLL C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\LargeTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-24_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\msmgdsrv_xl.dll C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-48.png C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square310x310\PaintLargeTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-100_contrast-high.png C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\MixerBranding\mixer_logo.png C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\PrivacySandboxAttestationsPreloaded\privacy-sandbox-attestations.dat C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXT C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-180.png C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Wide310x150Logo.scale-150.png C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\Timer3Sec.targetsize-24.png C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe

"C:\Users\Admin\AppData\Local\Temp\2025-05-15_72b0ab083a5365b77c915d60c0acb01f_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
IE 23.216.155.146:443 www.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 c.pki.goog udp
FR 142.251.37.35:80 c.pki.goog tcp

Files

C:\Program Files\7-Zip\7z.dll

MD5 a6b80f74e4ac9a3bb87c2dd4c2b993ab
SHA1 d0d14f9f1eb53665940b0a12d32cbb00f49af683
SHA256 b157332c1a88446f5915d51f8b4f5759cf833d6b2751902576cb7d495665d7fc
SHA512 5d8f36e395e04d26dbe47ca833a3552d077ae32844e2e048b75a1263b8eb4b00a831af0984d06b45a030519fe7bcc9799b04c53938907d02060d000108444fc3

C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL

MD5 57f77b62c7063af9b4defc0b5b27ba39
SHA1 c7dbd86cbdc98aa0ba305b90810f4bdfc360a4bb
SHA256 16c164affec1a2a9c8543778943d3737aae680ca564a0dbdd250f6f354f7292e
SHA512 3d5eb57f9e31cbdfa8132505d7d19fae1083c3ef3fd3d35f91f307896d0937df54d636aa731e38b6791a1544bca3dcaf495b08af10d946b9a43fe066b4cb8d18

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll

MD5 eed60bda42d47add8eb7ae99813327a3
SHA1 17ad59ac50606beeeee71a06dbe0b592ab77c76f
SHA256 902eaef6f160c900dbde07009646ba2dc737d0c5de73288941ea1b126b2c68cf
SHA512 1d5e2fa4f7965a6e8b9dde8482c4bca460a72246cdad95483401f0bd33c94db7ede12765a54de90ecf7dba48fa35667e8af95588a6c022d77277110ec8f86667