General
- Target 2025-05-06_f151daddb77744ec2a4682430ae6defb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch
- Size 4.1MB
- Sample250506-vebdcstrs7
- SHA256 70bc50a76d096ac1f81f782ee2a48b70ec9575d0941eb3f2ec0956a469b0fc14
Score
10/10
Malware Config
Targets
-
- Target 2025-05-06_f151daddb77744ec2a4682430ae6defb_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch
- Size 4.1MB
- SHA256 70bc50a76d096ac1f81f782ee2a48b70ec9575d0941eb3f2ec0956a469b0fc14
Score10/10Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
Gofing family
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
Renames multiple (51) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Drops file in Drivers directory
Manipulates Digital Signatures
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
Drops startup file
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Drops Chrome extension
Drops desktop.ini file(s)
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
Drops file in System32 directory