gofing

General

Target

2025-03-30_b30f365f08255e2128297748c80b168f_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch
Size

5.3MB
Sample

250330-xhgewswrz8
MD5

b30f365f08255e2128297748c80b168f
SHA1

fea92c5955ba118c3daf56c1a946e75e5238a350
SHA256

66e7b1ec39e7e5108495046e828f292f32c0cabd6bde2a82ffd7e7bfeaea0195
SHA512

701c45ecedc0972e98ebb66b2d5fa05c90e33dfb34a3d25d4cca5bfabd92c91a173ae3af4e9ae6659da3bba4cede671a758658313a7a0948dd2981e59cae48f9
SSDEEP

98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VQrWItDuB/sEXM:pWvSDzaxztQViWItDuBM

Score

10^/10

Malware Config

Targets

- Target
  
  2025-03-30_b30f365f08255e2128297748c80b168f_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch
- Size
  
  5.3MB
- MD5
  
  b30f365f08255e2128297748c80b168f
- SHA1
  
  fea92c5955ba118c3daf56c1a946e75e5238a350
- SHA256
  
  66e7b1ec39e7e5108495046e828f292f32c0cabd6bde2a82ffd7e7bfeaea0195
- SHA512
  
  701c45ecedc0972e98ebb66b2d5fa05c90e33dfb34a3d25d4cca5bfabd92c91a173ae3af4e9ae6659da3bba4cede671a758658313a7a0948dd2981e59cae48f9
- SSDEEP
  
  98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VQrWItDuB/sEXM:pWvSDzaxztQViWItDuBM
Score

10^/10

gofing credential_access discovery ransomware spyware stealer
- Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing family
  gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2