Analysis
- max time kernel
150s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/09/2026, 16:10
Behavioral task
behavioral1
Sample
2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
- Size 7.1MB
- Sample260913-tmlzds11fz
- SHA256 ec5036219cd56dfa6d27985573cb35a201f969547af249ae3ef209e867a9ded0
- MD5 3be46c7a5b2ca2d247a28a5f8c8259d7
- SHA1 6d0f26748a98e50c29548a5df28f82f49ed3fb5d
- SHA512 e02dcf748c8e47f049784c2b000982f419d0f7952dada4bef5f40454e1845b54220bd8188408204ad6893a46abcd6b0ade2af42ec8dd2aa2c58ea22c62288509
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VgzMmPVdeRou1X3jxmI7tugxDOHwuw:pWvSDzaxztQV0PaWuhzxmIJsQV
- TLSH T17976E003FC9564A9C5E9F23089B983527B71B858473163D72B64ABBB2E737C41E78390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 1 IoCs
resource yara_rule behavioral2/files/0x000300000001b21f-4.dat family_gofing - Drops desktop.ini file(s) 3 IoCs
description ioc Process File created C:\$Recycle.Bin\S-1-5-21-4154726816-2055034831-2297277433-1000\desktop.ini 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\desktop.ini 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\ResetDismount.ADT 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\next-arrow-hover.svg 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\added.txt 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\gu.pak 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\EdgeUpdate.dat 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\msedgeupdateres_nl.dll 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMXB.TTF 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationUI.resources.dll 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sl-si\ui-strings.js 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-gb\ui-strings.js 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\CourierStd-BoldOblique.otf 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\5732_13433615851328259_5732.pma 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-private-l1-1-0.dll 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ppd.xrm-ms 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMT.TTF 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\NAME.DLL 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.bmp 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\arrow-right.png 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\action_poster.jpg 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\he.pak 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-oob.xrm-ms 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\zh-hk_get.svg 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\he-il\ui-strings.js 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\EBWebView\x86\EmbeddedBrowserWebView.dll 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ppd.xrm-ms 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-140.png 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_sse2_plugin.dll 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_listview.svg 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fr-fr\AppStore_icon.svg 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\7-Zip\Lang\zh-cn.txt 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ppd.xrm-ms 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER32.DLL 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\Locales\hi.pak.DATA 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.TransformDataByExample.dll 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\MINSBPROXY.DLL 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libdemuxdump_plugin.dll 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.dll 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\id_MASCULINE.pak 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jre-1.8\bin\management.dll 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NetworkInformation.dll 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dummy.aff 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Common Files\System\msadc\ja-JP\msadcor.dll.mui 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Common Files\microsoft shared\ink\ta-IN\tipresx.dll.mui 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ppd.xrm-ms 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ro-ro\ui-strings.js 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-il\ui-strings.js 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\manifest.json 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Locales\ja.pak 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ul-oob.xrm-ms 2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-13_3be46c7a5b2ca2d247a28a5f8c8259d7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:3504
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.dll
- Size 5.9MB
- SHA256 9abd599986c7588d5363be726985fbbbb00bef987c242a76cee9cf7fb9fc54e6
- MD5 8c20bce3338a10cf38ba74f22932ff36
- SHA1 68193718f5ce3802d3b15aa0f3cd08815dde7a79
- SHA512 93221c68d219feeee4277ff9e88c90780e4953dd4c861d3a6e013642dfc1f62ca14b9b9c8e5b3ae8ab31010405c30ff25d4831c44bc446c29b0260b20cf1bd7f
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VS6H5ZPip/jqw+a2l:pWvSDzaxztQVS6H5ZqJfW
- TLSH T12956BF03FC9510A8D5E9F230897DD2927671784947366BD32BA0E7BB2A727C45FB8390
- MD5 SHA1 SHA512 SSDEEP TLSH