gofing

General

Target
2025-05-07_47a64e3eb9052129fba29da79d30558d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch
Size 4.2MB
Sample250507-epfstsfn2v
SHA256 3088cd70898191ccb3ab0b0fcf6a71da3fcfc6fb584bba0f67517bed9ac92f51
MD5 47a64e3eb9052129fba29da79d30558d
SHA1 08d2910e8baf3e46a2d545b009d1eda7c895446c
SHA512 fbeab0631bbcb2e18be84d43550f79afb29153accdcc1532126f1d2b31890f08e15b8c6628321c2e5005def19d1a532b4add561571e84f65e278ea1c80062746
SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4U:ieF+iIAEl1JPz212IhzL+Bzz3dw/VO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  2025-05-07_47a64e3eb9052129fba29da79d30558d_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch
- Size 4.2MB
- SHA256 3088cd70898191ccb3ab0b0fcf6a71da3fcfc6fb584bba0f67517bed9ac92f51
- MD5 47a64e3eb9052129fba29da79d30558d
- SHA1 08d2910e8baf3e46a2d545b009d1eda7c895446c
- SHA512 fbeab0631bbcb2e18be84d43550f79afb29153accdcc1532126f1d2b31890f08e15b8c6628321c2e5005def19d1a532b4add561571e84f65e278ea1c80062746
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4U:ieF+iIAEl1JPz212IhzL+Bzz3dw/VO
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

gofing credential_access discovery ransomware spyware stealer
- Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing family
  gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1