gofing | dc793bf6dc162fa0bed7fc521fda226cae5f0a6302660ce965bc887bf1a59498

General

Target
2026-09-10_abb522c1142093b0761418b14b213adb_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
Size 17.4MB
Sample260910-pfjs8ssgkf
SHA256 dc793bf6dc162fa0bed7fc521fda226cae5f0a6302660ce965bc887bf1a59498
MD5 abb522c1142093b0761418b14b213adb
SHA1 07500acbcef9c0394ee36df0f52596d30e6a246b
SHA512 ae9fdd58a9e962df281761e84b327214d0259988ace94c7856b38632dc2af33f322fe17c1b8f72e447a614b13ee91257be0bc20c630a246bdc3fbd7ca68e4c72
SSDEEP 393216:8KVUsMUkoTXoqBEO2oxni2Y2wQPyOMwh6:8QhkoTXoznoxi29wkNFh6
TLSH
T170071203FC9564A9C6E9F230897983927A717858473173D72B64ABBB2B737C41E78390
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-10_abb522c1142093b0761418b14b213adb_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 17.4MB
- SHA256 dc793bf6dc162fa0bed7fc521fda226cae5f0a6302660ce965bc887bf1a59498
- MD5 abb522c1142093b0761418b14b213adb
- SHA1 07500acbcef9c0394ee36df0f52596d30e6a246b
- SHA512 ae9fdd58a9e962df281761e84b327214d0259988ace94c7856b38632dc2af33f322fe17c1b8f72e447a614b13ee91257be0bc20c630a246bdc3fbd7ca68e4c72
- SSDEEP 393216:8KVUsMUkoTXoqBEO2oxni2Y2wQPyOMwh6:8QhkoTXoznoxi29wkNFh6
- TLSH
  T170071203FC9564A9C6E9F230897983927A717858473173D72B64ABBB2B737C41E78390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery gofing persistence privilege_escalation ransomware spyware stealer
- Family: Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2