General

  • Target

    2025-05-19_e03b6bdd59c48343da1d6776d7ebb5e7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch

  • Size

    5.1MB

  • Sample

    250519-na2lesfk21

  • MD5

    e03b6bdd59c48343da1d6776d7ebb5e7

  • SHA1

    36e0e6da6eee9bdad3674e6e390690490cdbda55

  • SHA256

    6f1c000b8d976984dc9833687e7dd63d9bad3a2c3615696e0cd0141acb8db807

  • SHA512

    9407ca51382f530b6bbe2aef701b81c05f33ef13114ca421316db31172b2096745dad7f8f636fdb068daf3390696eb89bdd7d02e896e146526582c8196b69a24

  • SSDEEP

    98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VYkU9V+wYFX:pWvSDzaxztQV12+bFX

Malware Config

Targets

    • Target

      2025-05-19_e03b6bdd59c48343da1d6776d7ebb5e7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch

    • Size

      5.1MB

    • MD5

      e03b6bdd59c48343da1d6776d7ebb5e7

    • SHA1

      36e0e6da6eee9bdad3674e6e390690490cdbda55

    • SHA256

      6f1c000b8d976984dc9833687e7dd63d9bad3a2c3615696e0cd0141acb8db807

    • SHA512

      9407ca51382f530b6bbe2aef701b81c05f33ef13114ca421316db31172b2096745dad7f8f636fdb068daf3390696eb89bdd7d02e896e146526582c8196b69a24

    • SSDEEP

      98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VYkU9V+wYFX:pWvSDzaxztQV12+bFX

    • Gofing

      Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

    • Gofing family

    • Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

    • Drops file in Drivers directory

    • Manipulates Digital Signatures

      Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops Chrome extension

    • Drops desktop.ini file(s)

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks