General

  • Target

    2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch

  • Size

    4.2MB

  • MD5

    a818eb5064fa0c5a4929baf32832853c

  • SHA1

    b01570952a997a9f2ef84d1a17f06bf54e93477f

  • SHA256

    0a6d055a00f21b3044aed28427d2cd4aadda46c986af2a1390c5e06af36fcf34

  • SHA512

    6640668b498c04f44f4853f5ec861d02a84183ab8c158fc027d3eee66b136c6710a705e26e6aefda4ecbb663be5547f299ab710233e66a5689b751f38ead1393

  • SSDEEP

    49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4y:ieF+iIAEl1JPz212IhzL+Bzz3dw/VNe

Score
10/10

Malware Config

Signatures

  • Gofing family
  • Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch
    .exe windows:6 windows x64 arch:x64

    c7269d59926fa4252270f407e4dab043


    Headers

    Imports

    Sections