Analysis
- max time kernel
150s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/09/2026, 12:55
Behavioral task
behavioral1
Sample
2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
- Size 4.1MB
- Sample260916-p56pasba63
- SHA256 8a3d887d74b62431d4a8fd999776fb7a27a6e2856544d41f93a0add66183325c
- MD5 47b0e546a2743e0a817098784458ea6f
- SHA1 3e034d02380c5b79ac303845f717c55fbdf43ff6
- SHA512 e72b64a2ef1ca0a288e304e380903aa4501e199e6992b466517dcf30faad1f1daa9fa2a34b1fc11a59f17c80bb11a3f5784901896922c9369f8840afa610c377
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4S:ieF+iIAEl1JPz212IhzL+Bzz3dw/Vs
- TLSH T15B169D03FC9564A9C5E9F23089B583927B71B858473123D72F64ABBB2A777C41E78390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 3 IoCs
resource yara_rule behavioral2/files/0x000300000001b2b3-4.dat family_gofing behavioral2/files/0x0003000000019f3a-5647.dat family_gofing behavioral2/files/0x000300000001a449-5675.dat family_gofing - Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Executes dropped EXE 1 IoCs
pid Process 5748 Process not Found - Loads dropped DLL 53 IoCs
pid Process 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found 5748 Process not Found - Drops desktop.ini file(s) 14 IoCs
description ioc Process File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\desktop.ini 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\$Recycle.Bin\S-1-5-21-560646293-820748483-2532804640-1000\desktop.ini 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\desktop.ini 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\COPYRIGHT 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Windows Media Player\de-DE\wmplayer.exe.mui 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\icons_retina.png 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-tw\ui-strings.js 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.dll 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\javaw.exe 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.tree.dat 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\dd_arrow_small2x.png 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\plugin.js 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\Locales\el.pak.DATA 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\1036\MSO.ACL 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\salesforce.ini 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\RepairTest.jpg 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner-4x.png 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\en_CA.dic 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\oneds.dll 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\lv.pak 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\wdag.dll 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ca_FEMININE.pak 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ja_NEUTER.pak 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-pl.xrm-ms 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-black\Device.ico 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.ServicePoint.dll 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\pt-br\ui-strings.js 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\he_FEMININE.pak 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\lv_FEMININE.pak 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-pl.xrm-ms 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.GIF 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\Common.PasswordManager.Resources.dll 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WindowsSecurityAppList.scale-200_contrast-black.png 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClientSideProviders.resources.dll 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-ma\ui-strings.js 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\es-es\ui-strings.js 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Locales\da.pak 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\3082\MSO.ACL 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\CANYON.INF 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libavi_plugin.dll 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\flavormap.properties 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-80.png 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\as90.xsl 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\THMBNAIL.PNG 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_asf_plugin.dll 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ro-ro\ui-strings.js 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\Microsoft.PackageManagement.MsiProvider.resources.dll 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ppd.xrm-ms 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\Validator.Tests.ps1 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Xaml.resources.dll 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Common Files\System\ado\msado26.tlb 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL116.XML 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_TestDrive.help.txt 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Locales\it.pak 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jre-1.8\bin\nio.dll 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\SpreadsheetIQ.ExcelServices.Resources.dll 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\theme-dark\Health.ico 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\MSFT_PackageManagement.strings.psd1 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\IwaKeyDistribution\iwa-key-distribution.pb 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeNullOrEmpty.ps1 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\s_checkbox_selected_18.svg 2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-16_47b0e546a2743e0a817098784458ea6f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2892
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.dll
- Size 5.9MB
- SHA256 3e7f8e688c886ce9202aba4603003fbf06163acb59c1dcf5aa236a31de6709fc
- MD5 eb12777045745832ff215bcdb701870f
- SHA1 235f9b6c6af8c03b277e68cb627d99e347947a57
- SHA512 2dc970d6042f63871f88537fca11a8bf6639f224aadf1359fed7bf169cafb8129f7ef4b337b5e6abc6023165eff41cd3c4e398e2f75dbf287b007c3ed5141525
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/Ve8qtzJ5DPPCGUus/:pWvSDzaxztQVtiVG
- TLSH T1AE56BE23FC9814A8C5E9F235896982927B717858433263E73F20A7BB2A737D45F78351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
- Size 4.4MB
- SHA256 49f4306c7ebaf5e13e049d52cc0a4b10d2a5aff4d348a3f737d9cd59f18a52e4
- MD5 f9778e46271eee61e61bfcc196de7c02
- SHA1 59460d5e9ec237345384a127835fe84e0c053c75
- SHA512 81f95f19595de6def9ced696a718011ba96c03e2851afd0b06672910de5fed3b2a622298dbb07241f8365f871bf42d98382ad5df56cda7775c16e2b802350c82
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VhzmdV:pWvSDzaxztQVKV
- TLSH T1CB269D03FC9594A8C5E9F231C97597927630B848573167D32BA4A7BB3AB37C41EB8384
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
- Size 192KB
- SHA256 0a245192d73aa92c1b4df9759bc3f33a49899527ab4a8f512417a54f7ffc17c6
- MD5 4dfecfca0e06f67a64395a9a5908f444
- SHA1 5dc94c06ea5c4ac66ade2e31b3c5c5327ad2fd4c
- SHA512 67788067ab794a5301735b55e44461d9aed36d4409d7ed1697102d660f601d22f31cfcd1379a60e40cdb120042ee734049691177d81b2e168f73774548483ef9
- SSDEEP 3072:eXE043979glhNHguo60Cs+JCr6eNvEXVTjWqX:ev4N72ruuo60CsZ6kaX
- TLSH T12114E79B689550E4D1FEE170822AB116BDA1309407383BE37F6186F11F27BF96A7C364
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
- Size 448KB
- SHA256 0a05e34bd42460fda26e2e66ad642862eb45a414f86233293936c0499a12b077
- MD5 89281221d2e67dbac4c63a6b6ab415de
- SHA1 5bd852b19374d13b1ac7fe904e98529a1eb793d2
- SHA512 5133b8819f1c961ce54829d8f041402a233f3e2425f1ee8ff86662ac27d790c232ee6b4fbb4aa05e37fef7e9d8afd95ea568010755091c517317c16cdad5eb4b
- SSDEEP 6144:ev4N72ruuo60CsZ6kaFnveexteerKUNm/Kd3xqn5I:V74uC0zm4exteeGwfzOq
- TLSH T1E0A4F797A8A510F4C1FEE1708626B116BD713094073827E77FA146F11FA6FE86A7C368
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
- Size 128KB
- SHA256 57926abe897b97bda386d26c72ee3680debc092f6a7bdd6e0f73819ff3a480f1
- MD5 c202471af68f6963ed2c51b895e2b092
- SHA1 93e9fbc0e5bbf9fe032c17db9fc3ce080107ba1b
- SHA512 5635eed5bc9af5b5181443b73e3c5ce8f107d69e95694e7f7936feb7b23ebc81a21b8b5579f08de86c65ea0e7b17a5e4569a1c7ed64f2afe070f4333c8538ac9
- SSDEEP 1536:eXvMCXhfjE3Lck7SEM9TimNFlhCdPeJq4C9vrUYUrYe24qdqdBANj:eXE043979glhNHguo60j
- TLSH T184D3089B689590E4D5FEE070862AB116BDB13094073837E37E6186F11F27BF96A7C324
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 5.8MB
- SHA256 4c8dce807324bc82c3d1dd08cd3d2f1378a7ad4bcd3497da5f3c66219de1d67a
- MD5 9cbdc55cfe9d652bf8fcf94a08c8fe3d
- SHA1 f1707c8a80bd5cf9cdb32461c16da45180b0fa03
- SHA512 5096c6b585d25a5c82919fece0514e790dcc8c8c1ccd237808a63ef9eb1b2b8d56dc31e2c2ef587ac7585af0ed942e012b5d638ccfe426eb3655d31ccfc7c239
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VYahRqgDqf+26xQAH:pWvSDzaxztQVZQrAH
- TLSH T1BA56BF43B8D454A9C6EDE53099B5829A3B727858033073D71B14FABB2B727E01EB9374
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 512KB
- SHA256 e1ab1191ce0505cd14be0e5d4a118410e5a5c676c4ace2b62abe7b8872b34b5f
- MD5 b0584298df5d97ddc235d7ce9bcb669c
- SHA1 738ac1f34b74521ed21c71f07f1acb620e6afbda
- SHA512 5c0d2049dd3cd9f01ec57f0dbcfd34f928b95075f120e54df7c26933deb7ddd7b7367855ce3a429516ca1d5501be708bed34e68b2fe158a79dd6ecc0af6621e1
- SSDEEP 12288:V74uC0zm4exteeGwfzO9rb/TrvO90dL3BmAFd4A64nsfJ/:ieKneLwfzO9rb/TrvO90dL3BmAFd4A6/
- TLSH T198B4E7A7A8A510F8C1FED170C629A117B9713095073837E36F9146F11FA6FE86A7C368
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 256KB
- SHA256 0614df1dbad4c4f66d54de657b3ed2c60f007ddeee19913ed8bef939658407f0
- MD5 71bd17e20824a91a4d03dc476d0d859c
- SHA1 f93d2a20a2ef8a8e316fbd3cdbd35d0eb1098ac1
- SHA512 c10bcbca8315ec00934bc2888b3e8f98a8f23543e8e4a46bef3ed92c8b35e7d3783c0a5b1b4680b5c2b53612846b0f441d0964c450736d855f8b645f54dd202d
- SSDEEP 3072:eXE043979glhNHguo60Cs+JCr6eNvEXVTjWqKqEUveUoiBzxu:ev4N72ruuo60CsZ6kaFnveexu
- TLSH T18044089B68A550F8D1FEE170862AB106BD713094073827E37F6146F11F26BF96A7C368
- MD5 SHA1 SHA512 SSDEEP TLSH