gofing

General

Target

2025-03-28_004695a17ca34f02437fe7be63e42583_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch
Size

12.3MB
Sample

250328-2xaccas1fy
MD5

004695a17ca34f02437fe7be63e42583
SHA1

f727f8d75084a4265bc893a4fb9f6620fd0e5420
SHA256

735201ab01cef7f438c8ab43fc13a4eb40020f03fee74aa98cd1a0ebb894182e
SHA512

dc4503a84fc01ac78409b86664338bce17245c8a92e78a858a5d09bdf39376182c1f2db3bd88888d8994d15cccacda354b200e05e680407a994ec9fb5f86ecfa
SSDEEP

196608:pWvSDzaxztQVyTNFl/hlLp2c8t3k/gjGyah9br+sFPOJ1yd+upRDXNfA:8KVIXl/hlN2c43k/02bqsFDdrzfA

Score

10^/10

Malware Config

Targets

- Target
  
  2025-03-28_004695a17ca34f02437fe7be63e42583_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch
- Size
  
  12.3MB
- MD5
  
  004695a17ca34f02437fe7be63e42583
- SHA1
  
  f727f8d75084a4265bc893a4fb9f6620fd0e5420
- SHA256
  
  735201ab01cef7f438c8ab43fc13a4eb40020f03fee74aa98cd1a0ebb894182e
- SHA512
  
  dc4503a84fc01ac78409b86664338bce17245c8a92e78a858a5d09bdf39376182c1f2db3bd88888d8994d15cccacda354b200e05e680407a994ec9fb5f86ecfa
- SSDEEP
  
  196608:pWvSDzaxztQVyTNFl/hlLp2c8t3k/gjGyah9br+sFPOJ1yd+upRDXNfA:8KVIXl/hlN2c43k/02bqsFDdrzfA
Score

10^/10

gofing credential_access discovery ransomware spyware stealer
- Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing family
  gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Renames multiple (52) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2