gofing | f68a2d4e52365efc2980d5ef569e8fdc23b4eeff5648685e5563d9de9ad5e21f

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 23:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Size 6.5MB
Sample260929-25jwraycjb
SHA256 f68a2d4e52365efc2980d5ef569e8fdc23b4eeff5648685e5563d9de9ad5e21f
MD5 68e0061bd21480998bac3f32fe913382
SHA1 9e34af634af3c9d5848d78520cb4ea783645a594
SHA512 d142f113640e3be36421425ff2ea6cb9eb58d7572258681fce525addc3afa731cdd10e4dfb3f2e600e0a34c6248550fba3d1cb1be9479171ff2b3e231f5c4caa
SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/Vahz3FhcGtjbhYlSy9dnZo:pWvSDzaxztQVAz33cSjGlS8Zo
TLSH
T13866CF03FC9564A9C5E9F23189B583927B71B858473127D32B64ABBB2E737C41E78390
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery gofing ransomware spyware stealer

Malware Config

Signatures

Family: Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
ransomware gofing

Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 3 IoCs

resource	yara_rule
behavioral2/files/0x000300000001b2c9-4.dat	family_gofing
behavioral2/files/0x000300000001a60c-5628.dat	family_gofing
behavioral2/files/0x000300000001a147-5636.dat	family_gofing

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 1 IoCs

pid	Process
4980	Process not Found

Loads dropped DLL 23 IoCs

pid	Process
4980	Process not Found
4980	Process not Found
4980	Process not Found
4980	Process not Found
4980	Process not Found
4980	Process not Found
4980	Process not Found
4980	Process not Found
4980	Process not Found
4980	Process not Found
4980	Process not Found
4980	Process not Found
4980	Process not Found
4980	Process not Found
4980	Process not Found
4980	Process not Found
4980	Process not Found
4980	Process not Found
4980	Process not Found
4980	Process not Found
4980	Process not Found
4980	Process not Found
4980	Process not Found

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 14 IoCs

description	ioc	Process
File created	C:\Program Files\desktop.ini	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\desktop.ini	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\$Recycle.Bin\S-1-5-21-461973139-3212354679-1508698038-1000\desktop.ini	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\cs-cz\ui-strings.js	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\playstore.png	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Linq.Resources.dll	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXC	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.VisualBasic.dll	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\it-it\ui-strings.js	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hu-hu\ui-strings.js	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Locales\af.pak	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\msedgeupdateres_af.dll	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MTCORSVA.TTF	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\vlc.mo	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationFramework.resources.dll	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\Added.txt	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_proxy\win11\identity_helper.Sparse.Stable.msix	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\msedgeupdateres_it.dll	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\VideoLAN\VLC\lua\sd\icecast.luac	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Windows Defender\de-DE\shellext.dll.mui	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.30704.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Asn1.dll	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-tw\ui-strings.js	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\msedgeupdateres_sr-Cyrl-BA.dll	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\updater.ini	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libvpx_plugin.dll	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\UIAutomationProvider.resources.dll	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\[email protected]	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\Describe.snippets.ps1xml	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ppd.xrm-ms	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-100.png	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_telemetry.dll	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\PREVIEW.GIF	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\System\ole db\xmlrw.dll	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\status.xml	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_delay_plugin.dll	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libgl_plugin.dll	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationFramework.resources.dll	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\FillSign.aapp	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\createpdf.svg	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_opencarat_18.svg	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pl-pl\ui-strings.js	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Inset.eftx	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSSOAP30.DLL	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\BreakAndContinue.Tests.ps1	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Serialization.Formatters.dll	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\circle_2x.png	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ro-ro\ui-strings.js	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-string-l1-1-0.dll	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Java\jre-1.8\lib\plugin.jar	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUIFormulaBarModel.bin	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\ui-strings.js	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\manifest.json	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\Locales\te.pak.DATA	2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

C:\Users\Admin\AppData\Local\Temp\2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_68e0061bd21480998bac3f32fe913382_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:5956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.dll

Path C:\Program Files\7-Zip\7z.dll
Size 5.9MB
SHA256 91af41a5400b763ebf093a965a5bccf85a4cbc493a50ec4e12dedb66f3f30fbc
MD5 1d9102bda79efb582584d11c1b9cae90
SHA1 728a408a409e0f313ae8f59e74b321fbaa77b77f
SHA512 573ae1a4e27ab2384c41c71645fe2e079c51fa0522b1504ae59f65b914e2aaaf536dd6c22866f765015112770eda4f16d82a5a133448f117e5ef8c4b1a671f12
SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VR4X36oL1qQHK2uX2RdX:pWvSDzaxztQVRe6vQqNmz
TLSH
T12356BF03BC9914A8C5E9E23085B5C3A27671B865073163E73B60EBBB6E277D51F78384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VISSHE.DLL

Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
Size 4.4MB
SHA256 af91801082df9799c8bdcc44cf507ebea6a46410327f6a131fa2bbebfa21ad81
MD5 5bc469c60fc0ff1e8e21751be2291d63
SHA1 d62feb206e3be0f387c85bf16d37e69e7716a17c
SHA512 014c7854f28de762fdba80fdd3d3ae5e88739e06294ba62243acd4b071358ecddfffdab51d93f874ee72181b1e4b869a60d4cbb09547064c0afc19d4b0ef238f
SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4s:ieF+iIAEl1JPz212IhzL+Bzz3dw/VAB
TLSH
T11626AD03FC9465B9C5EAF33189B582527A317848433123D72B61E6BB2A77BC81F79394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoshext.dll

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
Size 5.8MB
SHA256 3652a8b08157505a6af439ecb4e2c96671b5eefd0406cb04d60c1719a4f24a62
MD5 ce174af375924aa6cacdea50ee87670d
SHA1 2dd4f127b6545eb0ad9403b2c52396c35ade3f4d
SHA512 3e660d27ba31f3af5127e11dcfe7b3951456876f62831da8160910cb33fb80d6c8ee25792752eccda6c37cdba98ace16610077382c3c31375c6ffd673b0fbae1
SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/V3NzgfQ/HqboC:pWvSDzaxztQVPEB
TLSH
T1EA56BF43B8F454B5D5A9F6308569839777B07858E33023E32E67A6BB2A737C41E78390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads