gofing | fce5bee981c34c58ad9c6a1507cc92e2e2693fb7ac9441fea77b2cae65d21fb1

General

Target
2026-09-12_f9c8500c082ff182505692c9419e9adf_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
Size 18.5MB
Sample260912-rsvglsdb79
SHA256 fce5bee981c34c58ad9c6a1507cc92e2e2693fb7ac9441fea77b2cae65d21fb1
MD5 f9c8500c082ff182505692c9419e9adf
SHA1 79dd60936e14e32a9b1c760d04861a0384d76d48
SHA512 7c03f55f3c61bdba7109106a3e6b4545653679d1eca15842b81d41318635e5cd6daa4ad5880cffecb523645e7ad5e74241ff0e5f2b93dcb2532d94b9d41d303a
SSDEEP 393216:8KVxfd3kMG22WVwZeHkncC7G1OcNY6knDFV6KtxOAqd:88lUi2qw2l2GYrZV6Kdqd
TLSH
T1AD171203FC9564A9C5E9F230897693927A717858473123D32B64EBBB2A73BC45F78390
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-12_f9c8500c082ff182505692c9419e9adf_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 18.5MB
- SHA256 fce5bee981c34c58ad9c6a1507cc92e2e2693fb7ac9441fea77b2cae65d21fb1
- MD5 f9c8500c082ff182505692c9419e9adf
- SHA1 79dd60936e14e32a9b1c760d04861a0384d76d48
- SHA512 7c03f55f3c61bdba7109106a3e6b4545653679d1eca15842b81d41318635e5cd6daa4ad5880cffecb523645e7ad5e74241ff0e5f2b93dcb2532d94b9d41d303a
- SSDEEP 393216:8KVxfd3kMG22WVwZeHkncC7G1OcNY6knDFV6KtxOAqd:88lUi2qw2l2GYrZV6Kdqd
- TLSH
  T1AD171203FC9564A9C5E9F230897693927A717858473123D32B64EBBB2A73BC45F78390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery gofing ransomware spyware stealer persistence privilege_escalation
- Family: Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops Chrome extension
- Drops desktop.ini file(s)
behavioral1 behavioral2