gofing | a073ed0dcb63c4701dca26c54638e944dfae992182d8020bf186cbd5ccc71f57

General

Target
2026-07-29_5ff47a13931595923b4a1adbeedd6d86_cobalt-strike_frostygoop_ghostlocker_glassworm_hive_luca-stealer_salatstealer_sliver_snatch
Size 5.5MB
Sample260729-c856qavvcv
SHA256 a073ed0dcb63c4701dca26c54638e944dfae992182d8020bf186cbd5ccc71f57
MD5 5ff47a13931595923b4a1adbeedd6d86
SHA1 a99cc368c28e8abbaacd7199b1ca4b77c7c9f0b1
SHA512 b1dde0ef1cb74fa9a2d39a4cf38d50243e8f46599bfc7da257df4b1ac51aa9f17dc796db0ca1ec628cd2bf82e7f1aacb98453b4541bde1feb890169babf62ecc
SSDEEP 98304:weF+iIAEl1Jvz21MlhzL+Bzz3dw/VVG22LlKxZcWu:bW/SGzaxztQVVG/LlKZ4
TLSH
T1A646AE07FC8450A5D9E9C23088798BD2B7717845133523D32B75E6BA2B7BBC81E793A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-29_5ff47a13931595923b4a1adbeedd6d86_cobalt-strike_frostygoop_ghostlocker_glassworm_hive_luca-stealer_salatstealer_sliver_snatch
- Size 5.5MB
- SHA256 a073ed0dcb63c4701dca26c54638e944dfae992182d8020bf186cbd5ccc71f57
- MD5 5ff47a13931595923b4a1adbeedd6d86
- SHA1 a99cc368c28e8abbaacd7199b1ca4b77c7c9f0b1
- SHA512 b1dde0ef1cb74fa9a2d39a4cf38d50243e8f46599bfc7da257df4b1ac51aa9f17dc796db0ca1ec628cd2bf82e7f1aacb98453b4541bde1feb890169babf62ecc
- SSDEEP 98304:weF+iIAEl1Jvz21MlhzL+Bzz3dw/VVG22LlKxZcWu:bW/SGzaxztQVVG/LlKZ4
- TLSH
  T1A646AE07FC8450A5D9E9C23088798BD2B7717845133523D32B75E6BA2B7BBC81E793A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery gofing persistence privilege_escalation ransomware spyware stealer
- Family: Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2