*.gofile.io

Phishing Exfiltration Download

Malicious files can be uploaded on gofile.io and then have the direct link shared with targets in phishing attacks.

None

Attackers can upload data to gofile.io and share the link to themselves to download the exfiltrated data.

Attackers can keep their tools stored on gofile.io and when required, use the direct download link to fetch the tools.

https://www.hybrid-analysis.com/sample/345ee78ba847b524532e2844efe9e838fdff05a83cfdecb7b1e80a1e57dd2cf8/61859856ce4d9f692c5caee2