Overview

overview

10

Static

static

10

2025-04-03...ch.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-04-03_a9cb3ffafd0621b1d7c45883c646ae81_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch

  • Size

    5.1MB

  • Sample

    250403-vkryaszvdy

  • MD5

    a9cb3ffafd0621b1d7c45883c646ae81

  • SHA1

    94b72cc4955e71e818e924706141665b2ecdf8d6

  • SHA256

    b1176f3e2aae5b1755cc63bf9faa424d6b32258637c6635d9feee26b583e1091

  • SHA512

    b5d22f8e629c20f0fb6ee936db3f861226f5da2dd69fcbc85055e6232a86f7fed702fb89f5ef07796b4f46aac382d15cf69a2b27e7ebeb64b2679f21cbe4e008

  • SSDEEP

    98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VurbTGiYch1Ymn:pWvSDzaxztQVQqch19

Score
10/10
gofingransomware

Malware Config

Targets

    • Target

      2025-04-03_a9cb3ffafd0621b1d7c45883c646ae81_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch

    • Size

      5.1MB

    • MD5

      a9cb3ffafd0621b1d7c45883c646ae81

    • SHA1

      94b72cc4955e71e818e924706141665b2ecdf8d6

    • SHA256

      b1176f3e2aae5b1755cc63bf9faa424d6b32258637c6635d9feee26b583e1091

    • SHA512

      b5d22f8e629c20f0fb6ee936db3f861226f5da2dd69fcbc85055e6232a86f7fed702fb89f5ef07796b4f46aac382d15cf69a2b27e7ebeb64b2679f21cbe4e008

    • SSDEEP

      98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VurbTGiYch1Ymn:pWvSDzaxztQVQqch19

    Score
    10/10
    gofingransomware

    • Gofing

      Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

      ransomwaregofing

    • Gofing family

      gofing

    • Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

    • Drops desktop.ini file(s)

    behavioral1

MITRE ATT&CK Matrix

Tasks