Overview

overview

10

Static

static

10

2026-09-11...hi.exe

windows10-2004-x64

10

2026-09-11...hi.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    139s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/09/2026, 09:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
  • Size 14.5MB
  • Sample260912-ld7whatare
  • SHA256 f12d7b0872992dd6367e88e69ee63b48bbe8bf3d5eb35fa16ef79b8e1abfd977
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdiscoverygofingpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Signatures

  • Family: Gofing

    Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

    ransomwaregofing
  • Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 10 IoCs
  • Renames multiple (52) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 35 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 36 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"
    1⤵
    • Creates a file in the Startup directory
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    PID:2696

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.dll
        • Path C:\Program Files\7-Zip\7z.dll
        • Size 5.9MB
        • SHA256 4183b36a651197bc77cde37d98f2929fe94938b0154ceac913784221819314a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VISSHE.DLL
        • Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
        • Size 4.4MB
        • SHA256 ba55adb4707c249e139537c5a6732b22bd9f79760355b7b984381d89120e78aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 5.8MB
        • SHA256 0087caeaedcdc1b9eec2f60a0ff8b9d19f87d0b4a8e654cbe46955f51674096a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 5.7MB
        • SHA256 ff516457839fbe9cbc1970455ac1f7fa45f670e5ccd45e2301499dc0f208712a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 5.6MB
        • SHA256 6cbdf0a2268e3a6995a577b6363dcb0d8ec32e0fccda81e62fd512630e93c1c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 5.1MB
        • SHA256 8d8fa2de8b02bdded55cf46fac95251606bf86fbac812c24fe7d35b5eb8d7bb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 5.1MB
        • SHA256 6af3c9f322c5b2181d910f03ca805ff98b76d98232c1dafe2d58498e0969feac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 5.0MB
        • SHA256 ab3c0cd732e5b989b778af1fe00aed5e9bc0de3be6a8f8d25d6397bdadba163b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 4.9MB
        • SHA256 30161d29935a9ccb25651ab86cd6788b02597ce6bf0c90701f2de9e1fdb5f33e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 4.8MB
        • SHA256 826384529e350021a642aee82923481b19a67c575b019c1dbd40be80c3eb328a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download