Analysis
- max time kernel
150s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/09/2026, 17:15
Behavioral task
behavioral1
Sample
2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
- Size 4.1MB
- Sample260913-vspsxaar8s
- SHA256 7a5f669b6ef51d9986adcf7b5ee7ad0e6acdd7688c3628c5a1e443c3ba15a300
- MD5 1e9095743273f6861887a6aea057defc
- SHA1 a1cfd7a1dbe88f7060471959e53dbff7a84c5857
- SHA512 dfa53f99d9a678b74eb34026ad8a902216e4e991e604a34779e864b667f516a3a45f64d89222b909b978efd671160cf500c7b6f42448856ecd9c1bd40e47fe82
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4N:ieF+iIAEl1JPz212IhzL+Bzz3dw/VX
- TLSH T1A0169D03FC9564A9C5E9F23089B583927B71B858473123D72F64ABBB2A777C41E78390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 1 IoCs
resource yara_rule behavioral2/files/0x000300000001b221-4.dat family_gofing - Drops desktop.ini file(s) 3 IoCs
description ioc Process File created C:\Program Files\desktop.ini 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\$Recycle.Bin\S-1-5-21-1404337215-1550464601-2805570857-1000\desktop.ini 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-pl.xrm-ms 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\uk-ua\ui-strings.js 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\tpcps.dll 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jre-1.8\lib\ext\meta-index 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-utility-l1-1-0.dll 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\msipc.dll.mui 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ui-strings.js 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-exit-hover.svg 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\7-Zip\Lang\ja.txt 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\dxil.dll 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WWINTL.DLL 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\THMBNAIL.PNG 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-file-l2-1-0.dll 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\next-arrow-down.svg 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\7-Zip\Lang\pa-in.txt 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ppd.xrm-ms 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7FR.LEX 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Selectors.Resources.dll 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\twitch.luac 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\illustrations.png 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\main-selector.css 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\th_MASCULINE.pak 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jre-1.8\lib\security\blacklist 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\msmdlocal.dll 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\VVIEWER.DLL 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\System\vcruntime140.dll 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\vlc.mo 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationUI.resources.dll 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.resources.dll 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ppd.xrm-ms 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ppd.xrm-ms 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-180.png 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogo.contrast-white_scale-100.png 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\PUSH.WAV 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Design.Resources.dll 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Windows Defender\es-ES\MpEvMsg.dll.mui 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\resources.pri 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\COPYING.txt 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Quic.dll 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_nextarrow_default.svg 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-gb\ui-strings.js 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_fi_135x40.svg 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Locales\lv.pak 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\onramp.dll 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Locales\ug.pak 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jre-1.8\lib\management\jmxremote.password.template 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ppd.xrm-ms 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-80.png 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\SystemX86\mfc140.dll 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Mozilla Firefox\install.log 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libnormvol_plugin.dll 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\PresentationCore.resources.dll 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-phn.xrm-ms 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\c2rpridslicensefiles_auto.xml 2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-13_1e9095743273f6861887a6aea057defc_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2544
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.dll
- Size 5.9MB
- SHA256 2548ae28e6384276b832513ce4ba6cd5c96001adea4118e86b4cd5f9edd01c06
- MD5 d404c720874cf3596d913548c4155bbc
- SHA1 dd1dd6efad51575419cdd4593ced319197de18b0
- SHA512 a49e070e33fb805e343162a481d294b0547c4ff5a153a5ed646f473eb182c9711dff2207a02cefc3807a332b7dad1c01d2a8355190282e7d9fc3f289eee36054
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VcK1alL4PL:pWvSDzaxztQVRU4PL
- TLSH T16356CF03F8D424B9CAE9F231CD6582917A75785943313BD32B14EBBB2A72BD46E78350
- MD5 SHA1 SHA512 SSDEEP TLSH