Overview

overview

10

Static

static

10

2026-09-09...hi.exe

windows10-2004-x64

10

2026-09-09...hi.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    127s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/09/2026, 22:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-09_d7f50ce12fc00617586efdc15cd327af_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
  • Size 4.1MB
  • Sample260910-2v83wsxbpb
  • SHA256 49d61e7f4b4801bca35742e93137dbca2567002e64fc242343494064255bc035
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessgofingransomwarespywarestealer

Malware Config

Signatures

  • Family: Gofing

    Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

    ransomwaregofing
  • Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 19 IoCs
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 47 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 14 IoCs
  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-09_d7f50ce12fc00617586efdc15cd327af_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-09_d7f50ce12fc00617586efdc15cd327af_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    PID:6064

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.dll
        • Path C:\Program Files\7-Zip\7z.dll
        • Size 5.9MB
        • SHA256 8ac2e7e27a4254f17aa995ecb9efd19742485fc7b7c89e6e62ec9966e9fc43de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VISSHE.DLL
        • Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
        • Size 4.4MB
        • SHA256 27fe8af223628b96b62e18ca2cc4d45e610696506c2aec687b987f2d9f447d12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VISSHE.DLL
        • Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
        • Size 3.1MB
        • SHA256 2171b32bd788e920e54f774343e02861569019fd5b004d17caf4bfe2fdc3c5b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VISSHE.DLL
        • Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
        • Size 3.1MB
        • SHA256 f7de29011d7e4adaa09c1f233cd1b952f7a2b162497aed5d8f9079f599fb80ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VISSHE.DLL
        • Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
        • Size 2.8MB
        • SHA256 7f24c892b5fafcc94ffb18da28ada44dd764a1c915acadfb619f45353b852b70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VISSHE.DLL
        • Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
        • Size 2.9MB
        • SHA256 595c86e2d1d24dff950154b8e6b2ef5832c6490ab618bef3220f5b6b5a86af04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VISSHE.DLL
        • Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
        • Size 3.1MB
        • SHA256 4b842c8fc3ba198d41e31928e6f0b8edbfd7cd63f79656b449a4740276b48cb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VISSHE.DLL
        • Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
        • Size 3.0MB
        • SHA256 0caf04d9f00f4b1af2597db1ca0d96da4064f2d2677efcf9b07cb97e33c10ec4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 5.8MB
        • SHA256 a2a8940ffe4285493d48951ac5c8fc98d1a148a4c9a007d6318aaa87687f3edc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 5.8MB
        • SHA256 ac7348319eb52f698fdf42daeacad2d869c932062b8128723b22408c095480a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 2.7MB
        • SHA256 754f798edc5580150fb09be5afe6de04388c058eca108d11ed0ba615aed02384
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 3.3MB
        • SHA256 b287956c3a0c7d109a28d778cb6c49dfef4e4beb8d197e4607592ad2d171b91d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 3.1MB
        • SHA256 96fda4336936b56627cfea75642dc101fc3bbea495b25f3c9fca01b58198ee6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 3.1MB
        • SHA256 86b04a7459efbf520585136730d61586cf641847f05a8ab437bb2d2f60c24a52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 2.9MB
        • SHA256 d2624dd780d9d56b281b70c7c56063aded270380cd36362b99d7693559003315
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 3.0MB
        • SHA256 e09ff8c8bf926e7f82205e14b5f87326383cc788c803850ace55c4e11138398d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 2.8MB
        • SHA256 adf04efd02780eab28407165ef5f405d101a2cd94d75d3086cf1cc8c319ae87c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 2.9MB
        • SHA256 66ed9067df8eaaa9d9d0ba7f3058d340f66c5330e33d34b191a25194662d5f7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 2.8MB
        • SHA256 be8eb1ba876cd46ed276b990da8f50261c96b70d031813672431210d665cc34f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download