Analysis
- max time kernel
150s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 18:12
Behavioral task
behavioral1
Sample
2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
- Size 7.9MB
- Sample260925-ws6xvsshqh
- SHA256 f79fd89233953525ce2a561662a8fb8d3b21b3c9a8206fe1ad3e3e329cc417fa
- MD5 e529113eef02f02a5842d056b4e0f8a9
- SHA1 302eba190f32d11038b435265895f3dae99e5d94
- SHA512 909bc9dc7a4c234a1cd81680da9eac5c416dd082bc011e11aaca9400e71028c4a0480f2b705406f9a6fa26238c97f938c3241a87687fc6bdbb6412dd3f4776c7
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VsNG7zOMRAEmLUgYCuuW4HzuLmeUVekWR+J:pWvSDzaxztQVqMtdmxnW4qxUJnJ
- TLSH T19486E003FC9564A9C5E9F2308AB582927B717859473127D32F64ABBB2A737C41F78390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 3 IoCs
resource yara_rule behavioral2/files/0x000300000001b2f1-4.dat family_gofing behavioral2/files/0x000300000001a4f0-5598.dat family_gofing behavioral2/files/0x000300000001a014-5611.dat family_gofing - Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Executes dropped EXE 1 IoCs
pid Process 1468 Process not Found - Loads dropped DLL 28 IoCs
pid Process 1468 Process not Found 1468 Process not Found 1468 Process not Found 1468 Process not Found 1468 Process not Found 1468 Process not Found 1468 Process not Found 1468 Process not Found 1468 Process not Found 1468 Process not Found 1468 Process not Found 1468 Process not Found 1468 Process not Found 1468 Process not Found 1468 Process not Found 1468 Process not Found 1468 Process not Found 1468 Process not Found 1468 Process not Found 1468 Process not Found 1468 Process not Found 1468 Process not Found 1468 Process not Found 1468 Process not Found 1468 Process not Found 1468 Process not Found 1468 Process not Found 1468 Process not Found - Drops desktop.ini file(s) 14 IoCs
description ioc Process File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\desktop.ini 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\$Recycle.Bin\S-1-5-21-2251218687-1689653882-3767565116-1000\desktop.ini 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\desktop.ini 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-pl.xrm-ms 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\PROFILE.INF 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\SLATE.INF 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\librawaud_plugin.dll 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationCore.resources.dll 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\DebugDisable.001 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-oob.xrm-ms 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\NamedUrls.HxK 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.dll 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pt-br\ui-strings.js 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\learning_tools.dll 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Grunge Texture.eftx 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\BRANDING.DLL 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vreg\officemui.msi.16.en-us.vreg.dat 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libts_plugin.dll 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClient.resources.dll 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\PresentationCore.resources.dll 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jli.dll 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SCDRESPS.ICO 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\NL.ROGERS.COM.XML 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.UltraWinTree.v8.1.dll 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlSerializer.dll 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\UIAutomationClientSideProviders.resources.dll 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Windows Defender\MsMpLics.dll 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Microsoft.PowerShell.Operation.Validation.Format.ps1xml 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Xaml.resources.dll 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\ui-strings.js 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ja_135x40.svg 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\Locales\sk.pak.DATA 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hu_NEUTER.pak 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_FR.LEX 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.manifest 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Mail.dll 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\D3DCompiler_47_cor3.dll 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Diagnostics.EventLog.Messages.dll 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\msedgeupdateres_pt-PT.dll 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\OriginResume.Dotx 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libttml_plugin.dll 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Globalization.dll 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Tasks.Parallel.dll 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ca-es\ui-strings.js 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\README_en_GB.txt 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ppd.xrm-ms 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ppd.xrm-ms 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\dot.cur 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nl-nl\ui-strings.js 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\da_get.svg 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Trust Protection Lists\Mu\CompatExceptions 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\psmachine.dll 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.CSharp.dll 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Design.resources.dll 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\UIAutomationTypes.resources.dll 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\uk-ua\ui-strings.js 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\cstm_brand_preview2x.png 2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-25_e529113eef02f02a5842d056b4e0f8a9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:4840
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.dll
- Size 5.9MB
- SHA256 bd819fa04620a9776ce9ddcaffcb9a05bfdc9ad5f2156ecd9e4e13429bb16a94
- MD5 7cf80b542924cfcb4512118b4da803f6
- SHA1 61d1e2721cd18065851c9039e06cd3ecfecddbe2
- SHA512 29018337b954c04d51d5b8773d9dc21ce4661c02ecc574638c0893eb9eeaa09ccd4710da3fced09fce87e501cb622e9160610c9d840676aed822b3226c54e6cb
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/Vfu3UC4fI8m+DmHQfYJ:pWvSDzaxztQV4UCVHp
- TLSH T1D256BF43BCD419A8C5E9F230856582A3767178584B3177D32B21A6BF7AB3BC43E78784
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
- Size 4.4MB
- SHA256 ca9335689ea618f10ac9c647571965be893cf74370c6f841ad9a6925b1f5f3e9
- MD5 73c84a31ecf2a6e515e53a6cf3fea1e3
- SHA1 71bd5405bd236f3acd15382ef8a7aebbca9cf982
- SHA512 43100720e8ea0a11dd47f37ae5db3fda424efd6aa39a78103a9304ac6e603cd40ba8cabb19747af4522dc13aedfce4df1a0995cb8145f23081227ec967e182e3
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4x:ieF+iIAEl1JPz212IhzL+Bzz3dw/VHW8
- TLSH T18626AD43FCD564A8C5E9F2718A7583927A317848473133D72B64ABBB2A737C45EB8390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 5.8MB
- SHA256 76d8667e5403795b81ce5e1dd8f390adb018290355a35155a3fb50171f04251a
- MD5 dfb8bb45aa718cebf609b4090013a260
- SHA1 684ddbdbfd8d90d15dfbb1b1a808d321a14fe521
- SHA512 4e59b5b337f38cf3bc8f40b4688e03e7a2c163ee7e4f4d5584540694ed57daec70f9e02644a264c2c78f5d23644becc6ad990d16d53bf9783433f404065e961f
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/V3Npp1Dmgz0JgAQnp7NZ8EJM:pWvSDzaxztQV3Kgz0Jg/NZ3W
- TLSH T12956AF03B85914B9DAEDA1398A6542D67730BC44873163D32F68A6FF2B737C42EB8354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 55KB
- SHA256 c9f27eec598507e00f306b724b7dd9c5e96713d06ce70cf9c140287ae6c5bdba
- MD5 7c3c3e72157e9874297782c8323408d7
- SHA1 253603c43eff886fc186d16fcf2013e72098a52e
- SHA512 528eda918bc4896327e618caab3fa2f08dca0e362eddd36d189b1a73c8ae1bc985c3377e60fda0acfa4d26eadd8bc1f9060eb1665641c08c9d9b9d3b5cc8d01c
- SSDEEP 768:+vUQlX3/MHcDuYGANg0/fjE3Lck70Y9v7QXpMPdy8CnH89nlT6Hv/:eXvMCXhfjE3Lck7SEM3
- TLSH T1A443E89B69A580E4E5BEE1359725B116BD7170A4073827E37F6182F10F22FF86A7C318
- MD5 SHA1 SHA512 SSDEEP TLSH