gofing

General

Target

2025-03-30_5baf2c6dbc142c015b967226a9458f06_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch
Size

4.2MB
Sample

250330-xr3z9avtes
MD5

5baf2c6dbc142c015b967226a9458f06
SHA1

bc22f24e3b694a748c067816c11fba6557004e23
SHA256

9c38ed5f117376d3308f58e8d0a1fa7914944250134ba581fd3a08b3a957e493
SHA512

d9cea1233e4edc642668047ddce47bfb065391478a9a5e43278085e02a9cb285c3f221c05e743a8c59f436cbdd58d6fe5d64ea97983f11e363546dc95ae9ce0e
SSDEEP

49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4R:ieF+iIAEl1JPz212IhzL+Bzz3dw/VP

Score

10^/10

Malware Config

Targets

- Target
  
  2025-03-30_5baf2c6dbc142c015b967226a9458f06_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch
- Size
  
  4.2MB
- MD5
  
  5baf2c6dbc142c015b967226a9458f06
- SHA1
  
  bc22f24e3b694a748c067816c11fba6557004e23
- SHA256
  
  9c38ed5f117376d3308f58e8d0a1fa7914944250134ba581fd3a08b3a957e493
- SHA512
  
  d9cea1233e4edc642668047ddce47bfb065391478a9a5e43278085e02a9cb285c3f221c05e743a8c59f436cbdd58d6fe5d64ea97983f11e363546dc95ae9ce0e
- SSDEEP
  
  49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4R:ieF+iIAEl1JPz212IhzL+Bzz3dw/VP
Score

10^/10

gofing credential_access discovery ransomware spyware stealer
- Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing family
  gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Renames multiple (52) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2