File name:

2025-06-21_9274e9850ebab751374385a389813d7e_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch

Full analysis: https://app.any.run/tasks/ddf8e231-e3e0-4ee2-9cf6-38651fdc5783
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Analysis date: June 21, 2025, 23:28:29
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ransomware
gofing
fileinfector
golang
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows, 13 sections
MD5:

9274E9850EBAB751374385A389813D7E

SHA1:

C2EEC8ADC29F40363F27873584312FC358D5AEBF

SHA256:

B0ECF2DC38A19C4743EC99CCB46453D1D7F8EA274CA4636383087CB7A3435DFE

SSDEEP:

98304:/i6phhlaOhMkaIGzDJseMoC+xudYv3FE/ao3PYIuPZHaTH7inCnV8:w0JO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • RANSOMWARE has been detected

      • 2025-06-21_9274e9850ebab751374385a389813d7e_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe (PID: 3884)
    • GOFING has been detected (YARA)

      • 2025-06-21_9274e9850ebab751374385a389813d7e_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe (PID: 3884)
    • Steals credentials from Web Browsers

      • 2025-06-21_9274e9850ebab751374385a389813d7e_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe (PID: 3884)
    • Actions looks like stealing of personal data

      • 2025-06-21_9274e9850ebab751374385a389813d7e_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe (PID: 3884)
    • Modifies files in the Chrome extension folder

      • 2025-06-21_9274e9850ebab751374385a389813d7e_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe (PID: 3884)
  • SUSPICIOUS

    • Write to the desktop.ini file (may be used to cloak folders)

      • 2025-06-21_9274e9850ebab751374385a389813d7e_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe (PID: 3884)
    • Executable content was dropped or overwritten

      • 2025-06-21_9274e9850ebab751374385a389813d7e_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe (PID: 3884)
    • Suspicious files were dropped or overwritten

      • 2025-06-21_9274e9850ebab751374385a389813d7e_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe (PID: 3884)
  • INFO

    • Checks supported languages

      • 2025-06-21_9274e9850ebab751374385a389813d7e_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe (PID: 3884)
    • Application based on Golang

      • 2025-06-21_9274e9850ebab751374385a389813d7e_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe (PID: 3884)
    • Detects GO elliptic curve encryption (YARA)

      • 2025-06-21_9274e9850ebab751374385a389813d7e_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe (PID: 3884)
    • Creates files in the program directory

      • 2025-06-21_9274e9850ebab751374385a389813d7e_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe (PID: 3884)
    • Checks proxy server information

      • slui.exe (PID: 6584)
    • Reads the software policy settings

      • slui.exe (PID: 6584)
    • Creates files or folders in the user directory

      • 2025-06-21_9274e9850ebab751374385a389813d7e_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe (PID: 3884)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, Large address aware, No debug
PEType: PE32+
LinkerVersion: 3
CodeSize: 1319424
InitializedDataSize: 226816
UninitializedDataSize: -
EntryPoint: 0x63740
OSVersion: 6.1
ImageVersion: 1
SubsystemVersion: 6.1
Subsystem: Windows command line
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT 2025-06-21_9274e9850ebab751374385a389813d7e_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe conhost.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
3884"C:\Users\admin\Desktop\2025-06-21_9274e9850ebab751374385a389813d7e_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe" C:\Users\admin\Desktop\2025-06-21_9274e9850ebab751374385a389813d7e_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\2025-06-21_9274e9850ebab751374385a389813d7e_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6584C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6668\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe2025-06-21_9274e9850ebab751374385a389813d7e_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
3 655
Read events
3 655
Write events
0
Delete events
0

Modification events

No data
Executable files
456
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
38842025-06-21_9274e9850ebab751374385a389813d7e_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exeC:\ProgramData\Adobe\ARM\Acrobat_23.001.20093\AcroRdrDCx64Upd2300820470_MUI.msp
MD5:
SHA256:
38842025-06-21_9274e9850ebab751374385a389813d7e_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exeC:\ProgramData\Adobe\ARM\Acrobat_23.001.20093\AcrobatDCx64Manifest3.msiexecutable
MD5:5EDD2C7437BBB0C808EB22BB4A3249D1
SHA256:D703A7567FE74B31735C09F0FDE9E7BC2A6B9D3644E60F43741BFC3DD7E2A7CC
38842025-06-21_9274e9850ebab751374385a389813d7e_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.iniexecutable
MD5:0FD590BAC51736910957541586C6FDD4
SHA256:7F857FDCFA94DC22B4FD662DE0FE2886E7DA8E143D993D06DEDF2E2B1A4F1AFA
38842025-06-21_9274e9850ebab751374385a389813d7e_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exeC:\ProgramData\Microsoft\MF\Pending.GRLexecutable
MD5:C890CCD359A93D262CA60AF4AF0A0AD2
SHA256:6A6404223B7D801DCE2AB5D290404553156A8E03A1ECD203E884B44F9385D600
38842025-06-21_9274e9850ebab751374385a389813d7e_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exeC:\ProgramData\Adobe\ARM\S\388\AdobeARM.msiexecutable
MD5:278512959580EC2D14F6663B15A1F3BF
SHA256:6A38865811966615F4B33C8587A76452EB926567B187B61859EA9972EE2D818E
38842025-06-21_9274e9850ebab751374385a389813d7e_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exeC:\ProgramData\Microsoft\Windows\WER\Temp\16ab3579-ceca-43a8-9d5a-b14749faa335executable
MD5:0243DBBA2576DF7C2E5E6C0E3EB63B40
SHA256:7CD4F637A7B19C6572AD008076AD11A10376F995B979DCD68A818D86382C6272
38842025-06-21_9274e9850ebab751374385a389813d7e_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exeC:\ProgramData\Microsoft\Windows\WER\Temp\393134fa-f471-48fb-96b9-1870c6699f1bexecutable
MD5:C739C8ECEEAF04F9AC56192AA642E21C
SHA256:C37C5D2C72B77F0978CA1305CE0D8F76192A662C694782F9F5A2E62636A1F969
38842025-06-21_9274e9850ebab751374385a389813d7e_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exeC:\ProgramData\Microsoft\User Account Pictures\admin.datexecutable
MD5:83383A3C53D78C8D2B3F0638E5D81732
SHA256:754B1F49AD053FE736B7748DC0F8415FE6CD5E348A2F85B22C9E28C2B7A36664
38842025-06-21_9274e9850ebab751374385a389813d7e_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exeC:\ProgramData\Adobe\ARM\S\388\AdobeARMHelper.exeexecutable
MD5:F526803F8A84CB17E4815E8019E348D6
SHA256:5E226C206FDE4C74CA4C03DECC37894CDD2F5E1C53FCA154DD48EDB5B1B675BE
38842025-06-21_9274e9850ebab751374385a389813d7e_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exeC:\ProgramData\Microsoft\Windows\WER\Temp\11e41899-2897-4b03-864c-aa991f90f535executable
MD5:290DC785F9D7C0C24D436CE758017CCA
SHA256:064E105E42ADA9074C59608AAA2A72195B3EADA4D7A9C24656BDC9875398831D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
39
TCP/UDP connections
54
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
1268
svchost.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
4512
RUXIMICS.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
4512
RUXIMICS.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
POST
200
20.190.159.131:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
POST
200
40.126.31.69:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
16.7 Kb
whitelisted
POST
200
20.190.159.71:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
POST
200
20.190.159.0:443
https://login.live.com/RST2.srf
unknown
xml
11.1 Kb
whitelisted
POST
200
40.126.31.130:443
https://login.live.com/RST2.srf
unknown
xml
11.1 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4512
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
whitelisted
1268
svchost.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4512
RUXIMICS.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4512
RUXIMICS.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.174
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.159.131
  • 40.126.31.0
  • 20.190.159.129
  • 40.126.31.2
  • 40.126.31.130
  • 20.190.159.0
  • 40.126.31.69
  • 20.190.159.71
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.23
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info