Overview

overview

10

Static

static

10

2026-09-13...hi.exe

windows10-2004-x64

10

2026-09-13...hi.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    13/09/2026, 18:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-13_08ab03ab6263873a5f5a67e90c73119b_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
  • Size 17.4MB
  • Sample260913-wt3ltsbp2v
  • SHA256 0e2c9e407df7772167d11afbe62deca329777cb36b0f0ad8b387b0365729060b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdiscoverygofingpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Signatures

  • Family: Gofing

    Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

    ransomwaregofing
  • Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 8 IoCs
  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Loads dropped DLL 42 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 36 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-13_08ab03ab6263873a5f5a67e90c73119b_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-13_08ab03ab6263873a5f5a67e90c73119b_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"
    1⤵
    • Creates a file in the Startup directory
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    PID:872

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.dll
        • Path C:\Program Files\7-Zip\7z.dll
        • Size 5.9MB
        • SHA256 cdcca5c4e4e27975eee9930036cdc7de8dfa15476deb217d5d6070f3e93aa9c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VISSHE.DLL
        • Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
        • Size 4.4MB
        • SHA256 d89510ddffb68d77446fee83a878f53acb8916912ed1f22c2ccb6d7d1ff34427
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 5.8MB
        • SHA256 82aac7b4cb59633b8e06a441423c9f5f128cdf332c7133488c34b89eebce8b64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 5.4MB
        • SHA256 03c055966f6206f44871dec38aa050d14d86e10af4cc8829dc02f39003ecf4ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 4.8MB
        • SHA256 62e23b94a4637ffa7ca6e8ba9d9aa251bfc1f14a35d19465f9a6d780701ba6a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 4.9MB
        • SHA256 e3231e4822c8abe3f8a40b8a28194a7092fb4901aa31186d968a8a4cf86bd322
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 4.8MB
        • SHA256 79fa7c054064a78a79f9ea87db173491f6c458b471ac96335f4d2ea75c82388c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 4.1MB
        • SHA256 926425e9eb3d9d0a961b8658bedac89aee49ec4b144799356549eb4a63cb4eca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download