gofing | 91a96bb3e0fe731a5694ad70bc5a74b77fd4b458ebaf9d849a17a8578c672653

General

Target
2026-09-11_320bebcfcfb81696b88643348adffbe8_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
Size 7.1MB
Sample260912-nsa67awcpf
SHA256 91a96bb3e0fe731a5694ad70bc5a74b77fd4b458ebaf9d849a17a8578c672653
MD5 320bebcfcfb81696b88643348adffbe8
SHA1 27c8ace5f5507ef95e33602e2f567c80eebaaf76
SHA512 70c6220638c61ce3d62a466bf74d2151fc4768f9d40399c4c97c8834df8c20a60d90ce3cf68a8008728a8582417ea5ed8ed93cdfa195364d6b44731b6fd0ff89
SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/Vjf/aIZX9XR6EV7nDqt:pWvSDzaxztQVjfiIZXFJqt
TLSH
T13976D003FC9564A9C5E9F2308A7593927B71B858473123D32F64AABB2E737C45E78390
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-11_320bebcfcfb81696b88643348adffbe8_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 7.1MB
- SHA256 91a96bb3e0fe731a5694ad70bc5a74b77fd4b458ebaf9d849a17a8578c672653
- MD5 320bebcfcfb81696b88643348adffbe8
- SHA1 27c8ace5f5507ef95e33602e2f567c80eebaaf76
- SHA512 70c6220638c61ce3d62a466bf74d2151fc4768f9d40399c4c97c8834df8c20a60d90ce3cf68a8008728a8582417ea5ed8ed93cdfa195364d6b44731b6fd0ff89
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/Vjf/aIZX9XR6EV7nDqt:pWvSDzaxztQVjfiIZXFJqt
- TLSH
  T13976D003FC9564A9C5E9F2308A7593927B71B858473123D32F64AABB2E737C45E78390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access gofing ransomware stealer discovery persistence privilege_escalation spyware
- Family: Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2