Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/10/2026, 04:31
Behavioral task
behavioral1
Sample
2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
- Size 4.1MB
- Sample261019-e5hmcscy5l
- SHA256 73d68303799a9cf3285c577a2049a41203975cba505c6e970f8b1ac1709b5172
- MD5 58a887641cb361bd631a6ee7461838f6
- SHA1 4f64214ac219bad117e409ae4851c16983fe3b8e
- SHA512 44bc66422d9e5f62af84cb2d6cfd48ee9a2795da84387a3d4a550434c97070e63c787946b653b5bc76e45f1e3b731f2746669452188d92e4e6bce23212ff2de9
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4J:ieF+iIAEl1JPz212IhzL+Bzz3dw/Vv
- TLSH T11F169D03FC9564A9C5E9F23089B583927B71B858473123D72F64ABBB2A777C41E78390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 1 IoCs
resource yara_rule behavioral2/files/0x000500000001b2ca-3.dat family_gofing - Drops desktop.ini file(s) 3 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\desktop.ini 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\$Recycle.Bin\S-1-5-21-2714045687-1127350534-2056456672-1000\desktop.ini 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\ui-strings.js 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Locales\ko.pak 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-pl.xrm-ms 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\MAIL.OFT 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\rsod\office32ww.msi.16.x-none.tree.dat 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\MSFT_PackageManagementSource.strings.psd1 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\require.min.js 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ca-es\ui-strings.js 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MyriadPro-Regular.otf 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hi_FEMININE.pak 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sspi_bridge.dll 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-phn.xrm-ms 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ppd.xrm-ms 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Private.Xml.Linq.dll 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Accessibility.dll 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Royale.dll 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\msipc.dll.mui 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationProvider.resources.dll 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ja-jp\ui-strings.js 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\uk-ua\ui-strings.js 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\uk-ua\ui-strings.js 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\VisualElements\LogoCanary.png 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ppd.xrm-ms 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Windows Defender\shellext.dll 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\WindowsSecurityMedTile.scale-125.png 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.Json.dll 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fr-fr\ui-strings.js 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ppd.xrm-ms 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\OutlookMeetingReqReadNaiveBayesCommandRanker.txt 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.Cng.dll 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClientSideProviders.resources.dll 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationCore.resources.dll 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Common Files\microsoft shared\ink\gl-ES\tipresx.dll.mui 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ppd.xrm-ms 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\System\msvcp140_1.dll 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Windows Defender\de-DE\EppManifest.dll.mui 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fil_get.svg 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\as90.xsl 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\acrobat_pdf.svg 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-180.png 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\NAME.DLL 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-80.png 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\PREVIEW.GIF 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.TypeConverter.dll 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemCore.dll 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\ReachFramework.resources.dll 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_hover_2x.png 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\access-bridge-64.jar 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_it.properties 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveDrop32x32.gif 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ppd.xrm-ms 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\EssentialReport.dotx 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-17_58a887641cb361bd631a6ee7461838f6_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2416
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 4.2MB
- SHA256 023f16939158a755f0ba1082592a1316dd21e2f09e0e99faf354c2dc4115d3bf
- MD5 6ab42ef1eb4b5d761faf0e185b249d5d
- SHA1 642da40a07bfd6a060521c39cb4c21d3bdfa0f92
- SHA512 f06c63ea3ad9e5ffe38754fd724e20dcf711c10954c64c065733a087d0e7a64e7285c854f7466c70f5c03c5b429a70ed097ee0ed9e477dbbe9bf15c59d16006d
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4G:ieF+iIAEl1JPz212IhzL+Bzz3dw/V8
- TLSH T1B3169D03FC9564A9C5E9F23089B583927B717858473127D32F64AABB2E77BC41E78390
- MD5 SHA1 SHA512 SSDEEP TLSH