Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2025, 08:29
Behavioral task
behavioral1
Sample
2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Resource
win11-20250502-en
General
-
Target
2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
-
Size
4.2MB
-
MD5
264d96401490fd62ebdd0a924b09af59
-
SHA1
3b1c0e4a2464f205a38b8bf3525737e838b76332
-
SHA256
1323ca39b30040cd5a030c35c14cbc8b5ae1115ad0185c4dc2ff8c3bafe69108
-
SHA512
763b82082250cf6857c33b9945e8dd3a6ebeaf6804dae40a90efd01ebe647f6db6488f878d61d1e0019a0f9998209e2c270095c35d7545bc7bfe535da6e6e58c
-
SSDEEP
49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4f:ieF+iIAEl1JPz212IhzL+Bzz3dw/VU0
Malware Config
Signatures
-
Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
-
Gofing family
-
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 2 IoCs
resource yara_rule behavioral1/files/0x0003000000022a45-4.dat family_gofing behavioral1/files/0x0002000000022043-5477.dat family_gofing -
Drops file in Drivers directory 22 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\uk-UA\NdisImPlatform.sys.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\afunix.sys 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\gm.dls 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\gmreadme.txt 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Manipulates Digital Signatures 1 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Loads dropped DLL 48 IoCs
pid Process 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File created C:\Windows\Offline Web Pages\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Favorites\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Searches\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Videos\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Contacts\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Videos\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Downloaded Program Files\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Documents\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Pictures\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Favorites\Links\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\$Recycle.Bin\S-1-5-21-3623617754-4043701611-775564599-1000\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Desktop\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Saved Games\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Links\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Libraries\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\3D Objects\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\msrating.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\printui.exe 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\uk-UA\sppc.dll.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\es-ES\iscsiwmiv2.mfl 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\PerceptionSimulation\VirtualDisplayManager.ProxyStubs.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\Licenses\Volume\Professional\license.rtf 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\en-US\Ninput.dll.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\odbccu32.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\sv-SE\comctl32.dll.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\uk-UA\cmutil.dll.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Windows.Storage.Compression.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\iasdatastore.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\uk-UA\DeviceDisplayStatusManager.dll.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Dism\ja-JP\UnattendProvider.dll.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\NetSetupShim.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\de\Microsoft.AppV.AppVClientPowerShell.resources.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\dssec.dat 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\es-ES\DeviceDisplayStatusManager.dll.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\pdh.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Dism\ImagingProvider.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\uk-UA\tapiui.dll.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\nslookup.exe 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\uk-UA\inseng.dll.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Dism\it-IT\TransmogProvider.dll.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Storage\StorageHealth.cdxml 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\mmcbase.dll.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\en\AuthFWWizFwk.Resources.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\fr-FR\telephon.cpl.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\downlevel\api-ms-win-core-sysinfo-l1-2-1.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wincredprovider.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetworkTransition\MSFT_Net6to4Configuration.cdxml 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Storage\FileIntegrity.cdxml 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\fr-FR\PeerDist.dll.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\quickassist.exe 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\uk-UA\DevDispItemProvider.dll.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\en-US\hbaapi.mfl 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\fr-FR\msfeedsbs.dll.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\it-IT\ProximityCommon.dll.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wincorlib.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\p2p.dll.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ja-JP\imapi2fs.dll.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\en-US\InstallService.dll.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\fr-FR\mapi32.dll.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\msiwer.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\tvratings.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\F12\es-ES\F12Platform2.dll.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\FXSAPI.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\NetIPsecDospSetting.cmdletDefinition.cdxml 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\fr-FR\fixmapi.exe.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\it-IT\imapi2fs.dll.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\KBDFR.DLL 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Kds\Kds.psd1 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\ja-JP\TestDtc.psd1 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\iasrecst.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\it-IT\PhoneUtilRes.dll.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\it-IT\odbcji32.dll.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\jscript.dll.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\wshext.dll.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\dmdskres2.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\F12\uk-UA\F12Platform2.dll.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\atmlib.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\es-ES\sppc.dll.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\VpnClient\VpnClientPSProvider.Format.ps1xml 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\c_GSM7.DLL 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-64_altform-unplated.png 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\msvcp140.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-48_altform-lightunplated.png 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-left.png 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.Design.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.Themes.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-down.gif 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\it-it\ui-strings.js 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\it-it\AppStore_icon.svg 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\Mu\TransparentAdvertisers.DATA 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-phn.xrm-ms 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ppd.xrm-ms 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\webviewCore.min.js 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Primitives.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\ui-strings.js 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_output\libdirectsound_plugin.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-30_altform-unplated_contrast-white.png 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ui-strings.js 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nb-no\ui-strings.js 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\7-Zip\Lang\et.txt 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL058.XML 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\RedAndBlackReport.dotx 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SyncFusion.Grid.Grouping.Windows.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_altform-unplated_contrast-white.png 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ppd.xrm-ms 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\LibrarySquare71x71Logo.scale-125.png 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-16_altform-unplated_contrast-black.png 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-16_altform-unplated_contrast-white.png 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\InsiderHubLargeTile.scale-100.png 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hr-hr\ui-strings.js 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_48.jpg 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Xaml.resources.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\ui-strings.js 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\rsod\officemui.msi.16.en-us.boot.tree.dat 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSplashScreen.contrast-black_scale-200.png 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\LargeTile.scale-125.png 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosMedTile.contrast-white_scale-200.png 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pl-pl\ui-strings.js 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\mspdf.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\zipfs.jar 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\WideTile.scale-125.png 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TimerWideTile.contrast-black_scale-100.png 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Primitives.resources.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\fa.pak 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Client.resources.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\ApplySticker.png 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeWideTile.scale-200.png 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationCore.resources.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\example_icons.png 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-72_altform-unplated.png 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\PlayStore_icon.svg 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\msdaosp.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsBase.resources.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-125_contrast-white.png 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Photos.Viewer.Plugins.Native.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\s_listview_18.svg 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.WorkflowServices.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\v4.0_10.0.0.0_en_31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.resources.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\es-ES\Explorer.adml 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\netv1x64.inf 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Installer\SourceHash{E30D8B21-D82D-3211-82CC-0F0A5D1495E8} 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\de\SqlWorkflowInstanceStoreSchema.sql 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\de\System.Deployment.resources.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\ja-JP\TextInput.adml 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\Candaraz.ttf 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\InstallUtil.resources.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\es\Regasm.resources.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\de\aspnet_rc.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\System.Runtime.Remoting.resources.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\GlobalMonospace.CompositeFont 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\ChargeArbitration.inf 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\mdmusrgl.inf 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32.exe 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ES\System.Data.Resources.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ES\system.Resources.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Sockets.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\en-US\SettingSync.adml 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Boot\EFI\winsipolicy.p7b 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Boot\PCAT\zh-CN\bootmgr.exe.mui 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Cursors\size1_il.cur 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Cursors\size2_il.cur 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\coue1255.fon 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\c_fsundelete.inf 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationFramework.Aero.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles\App_LocalResources\manageSingleRole.aspx.de.resx 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Globalization\ELS\SpellDictionaries\Fluency\en-US\en_US_word_c.lm1 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\wvmgid.PNF 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CORPerfMonExt.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ES\caspol.resources.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\System.Workflow.Activities.resources.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\System.Net.resources.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\es-ES\UserExperienceVirtualization.adml 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\it-IT\EventForwarding.adml 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\acpi.PNF 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ES\System.Security.Resources.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_perf.h 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\sbscmp20_mscorwks.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\es-ES\MobilePCMobilityCenter.adml 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\PERFLIB\0C0A\perfc.dat 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\home0.aspx.de.resx 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.Compression.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\WorkplaceJoin.admx 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Speech\Engines\SR\de-DE\l1031.ngr 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Speech_OneCore\Engines\SR\es-ES-N\l3082.cw 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Speech_OneCore\Engines\SR\ja-JP-N\lsr1041.lxa 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\ipoib6x.inf 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\System.Numerics.resources.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\System.WorkflowServices.resources.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel.resources\v4.0_4.0.0.0_fr_b77a5c561934e089\System.IdentityModel.resources.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Prefetch\BACKGROUNDTASKHOST.EXE-858A19DE.pf 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Speech_OneCore\Engines\TTS\es-ES\NUSData\M3082Pablo.keyboard.wve 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\mdmusrk1.inf 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\WebAdminStyles.css 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\CreateAppSetting.aspx.ja.resx 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Roles\App_LocalResources\manageAllRoles.aspx.fr.resx 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\MSBuild.resources.dll 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\msjhl.ttc 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Media\Speech Off.wav 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_GlobalResources\GlobalResources.es.resx 2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2025-05-15_264d96401490fd62ebdd0a924b09af59_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops startup file
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2892
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD56ca3867f65dc7c5c79a036b5b8ef8018
SHA1d84f29d1b884fdc4b11dda9fbcdc47a168fd553e
SHA2562fa8b6974c2d0cb50d1628a606f2f8627ec9023d24a049c2dee3e0426869008f
SHA51264249119e08e960a7b43aa64dc9d8d9310b2a31394440f2cf8aa1db828c0dd69d9659b9088053c87386f4c1b418079e20f9e3fbe554993c8e7c3aea7c1bdfde6
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
Filesize5.8MB
MD5597779c34071d50efd17c1d3b8782d18
SHA1492da44b6c4d826bdecc903b6669f59657735ee2
SHA256a78d42338d7966cf67f5137dd848cfc32d155d8570016b3b5b557d8f2c019815
SHA5120d04023676b9cc2a7704acba1b66aba77c0bf3e5e5785a9e5c9e5681331fd071ad751f8fe716da48eac1095a7f5efe865a4f3a504c58b5579e2f5d550fb6b87d