gofing | 5f21e9902582952a19653dcbe02935b4c407395b4a65633691fd9efbc8868492

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 23:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Size 4.1MB
Sample261012-3hda5afc53
SHA256 5f21e9902582952a19653dcbe02935b4c407395b4a65633691fd9efbc8868492
MD5 40ceebb93bcea4b7a83eb6034610cbe6
SHA1 f3a2cf175204baf12951c85d5502fd3540d69b0d
SHA512 a6f0dc13c66c574d25aa6289f1344bd5f355a74ee2c2161313336135c63fe6d62e468876fe09cb80bf125871825fa1709d2a65b40701357a9867f26cb4ada9e3
SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4G:ieF+iIAEl1JPz212IhzL+Bzz3dw/Vc
TLSH
T167169D03FC9564A9C5E9F23089B583927B71B858473123D72F64ABBB2A777C41E78390
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

gofing ransomware

Malware Config

Signatures

Family: Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
ransomware gofing

Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 1 IoCs

resource	yara_rule
behavioral2/files/0x000300000001b1c3-3.dat	family_gofing

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File created	C:\$Recycle.Bin\S-1-5-21-461973139-3212354679-1508698038-1000\desktop.ini	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\desktop.ini	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\desktop.ini	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Locales\cy.pak	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\Example2.Diagnostics.Tests.ps1	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Java\jre-1.8\bin\verify.dll	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ppd.xrm-ms	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\WindowsSecurityAppList.targetsize-96_altform-lightunplated.png	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\nb-no\ui-strings.js	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\plugin.js	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ppd.xrm-ms	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\common.luac	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Locales\en-US.pak	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\hu.pak.DATA	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ul-oob.xrm-ms	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-oob.xrm-ms	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\Office15\pidgenx.dll	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL012.XML	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\vreg\proof.fr-fr.msi.16.fr-fr.vreg.dat	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\vlc.mo	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Primitives.resources.dll	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationCore.resources.dll	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Windows Media Player\Media Renderer\RenderingControl_DMP.xml	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\illustrations.png	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\CompleteCheckmark.png	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceYi.txt	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogo.contrast-black_scale-180.png	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.boot.tree.dat	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Design.dll	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\DirectWriteForwarder.dll	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationFramework.resources.dll	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-phn.xrm-ms	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\VideoLAN\VLC\npvlc.dll	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Annotations.dll	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\delete.svg	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_nothumbnail_34.svg	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Locales\da.pak	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ppd.xrm-ms	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Windows.Presentation.resources.dll	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClientSideProviders.resources.dll	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\icons_ie8.gif	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeNullOrEmpty.ps1	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Java\jre-1.8\lib\content-types.properties	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-pl.xrm-ms	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IdentityModel.Selectors.Resources.dll	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WindowsSecuritySmallTile.scale-100_contrast-black.png	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationFramework-SystemXml.dll	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\zip.dll	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\EXITEML.ICO	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\OcHelperResource.dll	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\ui-strings.js	2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-11_40ceebb93bcea4b7a83eb6034610cbe6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:3616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

7-zip32.dll

Path C:\Program Files\7-Zip\7-zip32.dll
Size 4.2MB
SHA256 a1ba4ae4bcc71f7e12eeec02e9f29b166baad3b133f2bfa5242f314d89b013ba
MD5 afef28148f8264f04c934f4cb08ace87
SHA1 5ff93b0a7e7ffe36531bf2d279d31edb7f17aecc
SHA512 33fc06e5963c7409475317b0b34f874d3a988c67416103967e6f91d092738072c58b314dafb8fdb187940d9418b0b67ca5de75cc583db014fb4b473dd459b4d8
SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4p:ieF+iIAEl1JPz212IhzL+Bzz3dw/VP
TLSH
T1E5169D03FC9564A9C5E9F230897983927B71B858473127D32F64AABB2E777C41E78390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download