General
- Target 2026-05-14_33d7138a5a6692f4d277dc5e6e13e633_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 8.4MB
- Sample260514-cgfrradv4n
- SHA256 a0b8c7dfe8769338346e202958dbe96388c9aea82f9aae910fd556cb2e491796
Score
10/10
Malware Config
Targets
-
- Target 2026-05-14_33d7138a5a6692f4d277dc5e6e13e633_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 8.4MB
- SHA256 a0b8c7dfe8769338346e202958dbe96388c9aea82f9aae910fd556cb2e491796
Score10/10Family: Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
Drops startup file
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Drops Chrome extension
Drops desktop.ini file(s)
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.