Overview

overview

10

Static

static

10

2026-09-28...hi.exe

windows10-2004-x64

10

2026-09-28...hi.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/09/2026, 10:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-28_f8171e0575b328e1df62ee7a2db2e3d6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
  • Size 4.1MB
  • Sample260928-mdbnqs1eph
  • SHA256 32d40bb2ad0d8302669e7e2f95c7341a9aaa6b9639c8cfa91cc4ebacc90a7ad0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdiscoverygofingpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Signatures

  • Family: Gofing

    Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

    ransomwaregofing
  • Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 12 IoCs
  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 38 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 37 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-28_f8171e0575b328e1df62ee7a2db2e3d6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-28_f8171e0575b328e1df62ee7a2db2e3d6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"
    1⤵
    • Creates a file in the Startup directory
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    PID:996

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.dll
        • Path C:\Program Files\7-Zip\7z.dll
        • Size 5.9MB
        • SHA256 2e032b98c3f47004629f3065c05602d161d3aa7191b277536d5bba07c103da9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 5.8MB
        • SHA256 6e9ad1464fe35ca7b5b2f57dfe1b3071e1590da3100ca3e42e4d953da065fe84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 5.8MB
        • SHA256 9357206a1765bf9732125660e1300c6668b748324031801564b7b33bcf6f6d1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 4.8MB
        • SHA256 58179cd93db6ca045c0894f837898ee790c852d19bd4a9352e92be6cfb6cd888
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 4.7MB
        • SHA256 d9a699c86f2dcd7adb3fa71bd7fa03534545dbc5ff7fa1a7818baae062eca2ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 4.6MB
        • SHA256 43469f89448e0871a2210e7e18f8f982845d4d93289bc1ab3f308c5f7e73fb4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 4.6MB
        • SHA256 bfe289b8a1cd2bc8debf2619689c426c121709a90e81f9e8bf1c9c589ebc039c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 4.5MB
        • SHA256 ea41f7452cdb63ebfc8746f8acd94b006fa2fc721ac8030d2045ece8efbd904f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 2.2MB
        • SHA256 42503105300479e0c84d4928463c14735b93e63f49f992a9d6387269d5a2bc53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 2.0MB
        • SHA256 82fe92ebb5406d15c822f5454ab1d269e6a645d3bed4b0da4400397f58f8f7b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 2.0MB
        • SHA256 be1e2a6bc09eca483727630f372c55d59cb1a6a2abe29fe1e2caabe542d3535c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 1.9MB
        • SHA256 8e22760467a4c9c10cf2b2629946ce188407459304da6767762f066cc1fe023c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download