Overview

overview

10

Static

static

10

2026-09-10...hi.exe

windows10-2004-x64

10

2026-09-10...hi.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    130s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/09/2026, 19:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-10_1cb6ec834ba901a83d46c5c16c919b9e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
  • Size 4.2MB
  • Sample260910-x35cfsxvds
  • SHA256 dc69aaadf211a908a716be3c319c2753a00c3ed29a3bb33710c8a141161f6ad9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessgofingransomwarestealer

Malware Config

Signatures

  • Family: Gofing

    Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

    ransomwaregofing
  • Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 26 IoCs
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 26 IoCs
  • Drops desktop.ini file(s) 14 IoCs
  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-10_1cb6ec834ba901a83d46c5c16c919b9e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-10_1cb6ec834ba901a83d46c5c16c919b9e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    PID:3436

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.dll
        • Path C:\Program Files\7-Zip\7z.dll
        • Size 5.9MB
        • SHA256 76a34033530182f3b789e2e1055126454eee29ab29c06cd9a65b87613be0a940
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VISSHE.DLL
        • Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
        • Size 3.4MB
        • SHA256 276099e8c93d91642d1c287ecadaa63b35f37c8d8a76900d8952621ef1e45792
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VISSHE.DLL
        • Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
        • Size 4.0MB
        • SHA256 6db7d95fac4e1faf336e5be9a09ca1d46466758ad250e7f7b8d421a0ba170a29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VISSHE.DLL
        • Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
        • Size 3.9MB
        • SHA256 6ef7dd3c7d8003e669a26040995e91316c3d0899d762bd966f589eca1ab91ae4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VISSHE.DLL
        • Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
        • Size 4.1MB
        • SHA256 1a8c09a311da4f92a973c9e540cfde1a2158bc7807f5c84611ba684146c00739
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VISSHE.DLL
        • Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
        • Size 4.4MB
        • SHA256 413bfafda95362ea64302934ed610f8078eadf4e57adc0f559c6b0cfd8925a42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VISSHE.DLL
        • Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
        • Size 979KB
        • SHA256 02eb9e3460758d743a202c682dd77a89fe6d67bde8ab004696df93045a536f97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VISSHE.DLL
        • Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
        • Size 960KB
        • SHA256 2d4a0746d467c1586b4824e908579d21cf36d350872ab103b93998a12f9c45b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VISSHE.DLL
        • Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
        • Size 752KB
        • SHA256 dca57710a5be95a3586c8a50d07ee406a367a2ec94b7706387aeb53b7fa60ce3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VISSHE.DLL
        • Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
        • Size 1.1MB
        • SHA256 f265bb70adc459153e36ba5ba76e7695f9cebb40ff85f139591e440d66ca4406
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VISSHE.DLL
        • Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
        • Size 941KB
        • SHA256 f9216b7c3273896088ddaa676374939ee1dc9e0fd9a6f4d1777d7e1a1a4fd50b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 5.2MB
        • SHA256 5bf19a5fcfc4b514f56c7b26a2ba0df96fe389eddcf04e4c0f948aa48be3b8fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 5.0MB
        • SHA256 a14724d87ba846f0c0c2e3c7191bce7d5c4d5783f0aa5451585e2b614f6429f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 4.5MB
        • SHA256 b8f0ca9ca1c65e028674388f7bb0032713015a3cff01d27bfabc44f93505cd74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 4.1MB
        • SHA256 c83a0bd3dc73b43d4ff8b5decb531e772d766a66b22af560f2a6fae3279ab6be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 4.6MB
        • SHA256 5c02e8bb80cf0bcd78d29c5f286872edef59808463b576da3a117f3d45842882
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 5.0MB
        • SHA256 95a673a8a2dfbb1b8ec474bf8a89cf5c40b63a1438a5d1fe9ce94eb54bfde1f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 4.1MB
        • SHA256 5298a6c0f989fb83bb8c842a868715f19efe9918ed43ee14ad228f13e9b8d789
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 4.3MB
        • SHA256 0bdc169aed26b562e7eb9a4f50a937c58f41cf9ccb02c29ef5d0dec1d149f7a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 4.4MB
        • SHA256 36366754f783bbeca00636f4414d4f54367cbdf6b6f735170e3429dfad16628b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 4.1MB
        • SHA256 ddb8f82d4a5fa18cdfbe96f6604260401c6c5e71e13fecc1396392c991202a38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 4.6MB
        • SHA256 1bddb8cb70a986f161c17a418464f9aed9b8a25f1051268b4453e74b3d11be8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 3.9MB
        • SHA256 4f8038ecbf7609d831293addedc02c3e37947cc0c89eefdff618535cc142905e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 3.8MB
        • SHA256 5b65783754d70daacd3c31d0a4474de71dfd63bd33d14cb0bb930c049dfbafb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 4.3MB
        • SHA256 54cfa5e18a0665fc2b6096430e4f3bdde2cbfedb417e9db94afebdd6c33801b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 3.8MB
        • SHA256 747cb43d14c7dcd8c3e5c6a48f47bde2e6c5ebc0f17cfc236fd8eb083b9aee5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 4.3MB
        • SHA256 57207579382ba8eb52a862e347c8c2629fb1d3fac4ba43a01fafc13cd8a51317
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 4.1MB
        • SHA256 926425e9eb3d9d0a961b8658bedac89aee49ec4b144799356549eb4a63cb4eca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 3.3MB
        • SHA256 610bf7191ddee18a1d648b7f0aaf25c98aecfcf93cc6284a6d02af23789bc62a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 2.9MB
        • SHA256 a2a1fbe7c157399065a7d86b5ee2e9ea87e50d28328d99520f8246cfb262b516
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 3.5MB
        • SHA256 2c45ffa737fc029f6c63579b87928824b2dfb389d2d7362a54f0924122fcf848
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 1.0MB
        • SHA256 976b930fc91bf06909bc2c866de18ea786e992e4367e09928140dc585d5361ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 907KB
        • SHA256 cada87534bf9e979eff8c083756e944463be5b3abfd19034492eaad62bf09633
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 998KB
        • SHA256 1cbc4ea7cc7e578a9ff89baad4377415d09f8f6c345ea42784086a252284d5b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 910KB
        • SHA256 a61ae2a838d8284ea02e3df8e8691c5a4b02e4d5f5956a29a46bcdd91b09447a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 938KB
        • SHA256 65260d1cb2e2dfcbb54e24d50f322d00edae2850b444be9cb017e05b2eb2dc45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 1.2MB
        • SHA256 d8b26f3a64ba0eeb2aeb61ebe8d7f841fcdec16502c8692eba2bc052eed8080f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 982KB
        • SHA256 fea58cbbe7b3fdf1ec61b7867a02b8b5d81d9975f9ec512c7c43b8df57c094cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 944KB
        • SHA256 b4935f2a29782bb6d41f1a1ce810e153170f33048a768d59db727d71690dc926
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 846KB
        • SHA256 fbd0114a18dbcea45123726369754adafa484455489e2c4b0511f4145dd4d1bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 977KB
        • SHA256 b49167a7bdaae9c180af6329b2bf2eec5522e8c9c3550ca4996e6a87730223fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 832KB
        • SHA256 2782f27e32d46c487f85bbbae195f099feb4e8afd8d831b7046229da8814b786
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 1.1MB
        • SHA256 b1bd19e610faacf54a35ca608ff70b1004a4cc04125a7a5365532f9cc5d59a65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 1.0MB
        • SHA256 bd741c7c62a82d3666646644e75db92dff7a51ff810afde23156cf2af863c7a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 844KB
        • SHA256 2a4c4ae720cf7cd9bb2cf624ac1fab478eea31527ad2e6ec666b55d65de9c5ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 766KB
        • SHA256 43ace62a3013df365faa48075198cbed433ccb8b3879d8ef69992d645a1cb243
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 1.1MB
        • SHA256 cf10bef17d8a7614c62d1f942701b52f1f5448a556977427204d5cac6be75626
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 807KB
        • SHA256 4b200fc48b0733e17d17dd956187d737a8779aeb96db3b3753092eb7e06078ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 1.0MB
        • SHA256 2d5d8ebb7b821ed6f3c95442201a6b6590c6245423cb3ced372ed658d86f662c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 654KB
        • SHA256 deda0f625e91d98d87f54effa3cee4ff37b7816d83bd69563e6cc6eaaa598245
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 746KB
        • SHA256 52719b0c742a834ff7af4091a6a2df17694a301edd158a5fad19d0560e205086
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 667KB
        • SHA256 c134340bc8859b660a79cb53699eb670ce173d7c3bc0bfa3eb79007690a786ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 668KB
        • SHA256 6fd28ffa4a952d08562a446cbfc2854238a65103facc9c38394d5891c68de00d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 768KB
        • SHA256 320eeb429b8fee8821effc51dc08797fc740e585b1f6ba9c99fe01a66c01b14d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 871KB
        • SHA256 82d70ee48b011ad03a9b394d5af75f5cf3d6faed79c97921489fc76a1766f945
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 749KB
        • SHA256 eca43f490a01b96f90ec0693e78a3c73dbe3567d2d02f126e0f9a46260793b36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download