gofing

General

Target

977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802
Size

33.3MB
Sample

250403-rxj7faxya1
MD5

158c2e6b90ab30f6fdf653255a2beba0
SHA1

3288d9c8fb3642d2d60f534dd05a7b24417dfffd
SHA256

977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802
SHA512

6003425b0c92b3ebd7608070b1509e6de2148762dec291c44a6fda954bf1b4849542a6115987333267c67ee65b88416d1e6ad80a0bd8969020fa459916258a8d
SSDEEP

786432:8hl/8uLBgD7MkrYvUL8QHYx/2FHiPtP4erWXCYlOFOrAaP:878kOD7HnLVYxOFHiPZ4eD+

Score

10^/10

Malware Config

Targets

- Target
  
  977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802
- Size
  
  33.3MB
- MD5
  
  158c2e6b90ab30f6fdf653255a2beba0
- SHA1
  
  3288d9c8fb3642d2d60f534dd05a7b24417dfffd
- SHA256
  
  977403e8a424d1a029369b715867c3056a4d0d8a1c75dcf9d84d9c56f9bcf802
- SHA512
  
  6003425b0c92b3ebd7608070b1509e6de2148762dec291c44a6fda954bf1b4849542a6115987333267c67ee65b88416d1e6ad80a0bd8969020fa459916258a8d
- SSDEEP
  
  786432:8hl/8uLBgD7MkrYvUL8QHYx/2FHiPtP4erWXCYlOFOrAaP:878kOD7HnLVYxOFHiPZ4eD+
Score

10^/10

gofing credential_access discovery ransomware spyware stealer
- Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing family
  gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Renames multiple (51) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1