gofing | d19f3d1044b5fcdc37ad65d9f5b427457f2fa694c49b6382a7c44c6e62455b66

General

Target
2026-09-12_d0ef7ad947e45b9f8da9e4b7e6e2957c_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
Size 14.5MB
Sample260912-vpetja1dma
SHA256 d19f3d1044b5fcdc37ad65d9f5b427457f2fa694c49b6382a7c44c6e62455b66
MD5 d0ef7ad947e45b9f8da9e4b7e6e2957c
SHA1 40a1df19e85d0fa007fca74e82b7841e6fba2abb
SHA512 1adf6a8937bbd99c4e89ed5eaa13b51bd193160ee35276817cc0243c52ff4039026424b8e41a4635f394688c653f350ede09e589db340333db7c5f1abc6010bb
SSDEEP 196608:pWvSDzaxztQVNvJpGeeZkHq4Q5wzxfJe/yrtco1hpc769fjvtU77233aR+zpQWO:8KVDrK6pQ5wzLe651DAMfjleaHaRj
TLSH
T110E60203FC9564A9C5E9F2308AB583927A717858473127D32F64AABB2E737C41F78394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-12_d0ef7ad947e45b9f8da9e4b7e6e2957c_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 14.5MB
- SHA256 d19f3d1044b5fcdc37ad65d9f5b427457f2fa694c49b6382a7c44c6e62455b66
- MD5 d0ef7ad947e45b9f8da9e4b7e6e2957c
- SHA1 40a1df19e85d0fa007fca74e82b7841e6fba2abb
- SHA512 1adf6a8937bbd99c4e89ed5eaa13b51bd193160ee35276817cc0243c52ff4039026424b8e41a4635f394688c653f350ede09e589db340333db7c5f1abc6010bb
- SSDEEP 196608:pWvSDzaxztQVNvJpGeeZkHq4Q5wzxfJe/yrtco1hpc769fjvtU77233aR+zpQWO:8KVDrK6pQ5wzLe651DAMfjleaHaRj
- TLSH
  T110E60203FC9564A9C5E9F2308AB583927A717858473127D32F64AABB2E737C41F78394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

gofing ransomware credential_access discovery persistence privilege_escalation spyware stealer
- Family: Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2