gofing | 0b526e73ea6f2454a6e102cc17c2ba5524f9e30ea92031b337732fbc642b3809

General

Target
2026-09-12_fdfc6afa5f2ea43dc00eed7245be475f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
Size 5.7MB
Sample260912-ree5rsycmd
SHA256 0b526e73ea6f2454a6e102cc17c2ba5524f9e30ea92031b337732fbc642b3809
MD5 fdfc6afa5f2ea43dc00eed7245be475f
SHA1 39353295f421b498d6fd5c4497f4e283ebd81df3
SHA512 d1ae41da5d2a706305abb11019325f28e28a256c00928c016a84829628afdff449a115b085125e40e2a8cc30e8aa9cff6fc3d8ba1ff7d05ecb95585b47b6ede9
SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VJ8m1SJlSCck/L:pWvSDzaxztQVAJ5ck/L
TLSH
T17A56AE03BC9911B9D1E5E13495B6D2533634BC894B2627E32A61B7FB2E7A7C09F78340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-12_fdfc6afa5f2ea43dc00eed7245be475f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 5.7MB
- SHA256 0b526e73ea6f2454a6e102cc17c2ba5524f9e30ea92031b337732fbc642b3809
- MD5 fdfc6afa5f2ea43dc00eed7245be475f
- SHA1 39353295f421b498d6fd5c4497f4e283ebd81df3
- SHA512 d1ae41da5d2a706305abb11019325f28e28a256c00928c016a84829628afdff449a115b085125e40e2a8cc30e8aa9cff6fc3d8ba1ff7d05ecb95585b47b6ede9
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VJ8m1SJlSCck/L:pWvSDzaxztQVAJ5ck/L
- TLSH
  T17A56AE03BC9911B9D1E5E13495B6D2533634BC894B2627E32A61B7FB2E7A7C09F78340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access gofing ransomware stealer discovery persistence privilege_escalation spyware
- Family: Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2