Analysis
- max time kernel
140s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/09/2026, 19:08
Behavioral task
behavioral1
Sample
2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
- Size 5.7MB
- Sample260913-xtklpacn7v
- SHA256 5db3fec017255b829b02922387fe5f94585fe31a2fc0a42d5321277510c2033c
- MD5 f916a34ee69171b69ce0b874f86ebbf3
- SHA1 5f9c380e37650749bbb50f686dca1eb0b2b1c5b0
- SHA512 c63c48bc3acd5fda7c374417d5edf94df612ebb9042ea058098371d76aaccd92271f9e9bb65f64a6e6f63c61ce0cec89062d339265879a88cf220bdde3d090ca
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VaYXEnPG/w9Rmgt84H:pWvSDzaxztQVakaPco5u4H
- TLSH T1C356BF03FCE161A4E5D5F17288694652B6307C94473623D32B92EBBF2A26FE48F35358
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 1 IoCs
resource yara_rule behavioral2/files/0x000300000001b21f-4.dat family_gofing - Drops desktop.ini file(s) 3 IoCs
description ioc Process File created C:\$Recycle.Bin\S-1-5-21-4154726816-2055034831-2297277433-1000\desktop.ini 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\desktop.ini 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Utilities.v3.5.resources.dll 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.30704.0_x64__8wekyb3d8bbwe\vcruntime140_app.dll 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\progress_spinner.gif 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\images\example_icons.png 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\vulkan-1.dll 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterBold.ttf 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11cryptotoken.md 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\GKExcel.dll 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\selection-actions2x.png 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ContemporaryPhotoAlbum.potx 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Primitives.dll 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\ui-strings.js 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\msedgeupdateres_fa.dll 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\msedgeupdateres_lt.dll 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_large.png 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\msvcp120.dll 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_sv_135x40.svg 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-pl.xrm-ms 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\Close2x.png 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Locales\gd.pak 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\dxcompiler.dll 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-filesystem-l1-1-0.dll 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE\THMBNAIL.PNG 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\theme-light\Family.ico 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Forms.Primitives.dll 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\plugin.js 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore.dll 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Design.resources.dll 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef-ui-theme.css 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ca-es\ui-strings.js 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_company.png 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libdiracsys_plugin.dll 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Windows Media Player\es-ES\wmpnssci.dll.mui 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClientSideProviders.resources.dll 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\en-US\oledb32r.dll.mui 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\mr.pak.DATA 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.dll 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Locales\en-GB.pak 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe.manifest 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\nl7lexicons0011_v2.dll 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ja-jp\ui-strings.js 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\OWSSUPP.DLL 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\msotelemetry.dll 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_a52_plugin.dll 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\plugins\visualization\libprojectm_plugin.dll 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.PowerBI.AdomdClient.dll 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Windows Media Player\Media Renderer\DMR_48.jpg 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.8_8.2310.30001.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\PresentationFramework.resources.dll 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms 2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_f916a34ee69171b69ce0b874f86ebbf3_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:3752
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.dll
- Size 5.9MB
- SHA256 80653aaa8a141004ae1516744ca035e310b39621d20328cc58244a6730552fd8
- MD5 f5d8c78e2e8013fe5859f954205cbf4f
- SHA1 fccdc63b1cab2cd24d55e149bd5574449075a0db
- SHA512 05d268ba0e2ecb78f3e280754ffc091e9c94835641c6970a776ac11452d1269346159a1c552e4878bc05beba51fffdf53a685ea4448aac500e0c085cff3993f3
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VFFc9K5297QNRnByQNcnD:pWvSDzaxztQVzc797QNRno8cnD
- TLSH T15F56BF47FCA518ECD9EAF2708966C362B6317854173163D32F25A6BB3A76BC41E78340
- MD5 SHA1 SHA512 SSDEEP TLSH