gofing | e3a5431d09285e45c7dbf3bf8e19beafd6f6bd0ded078c3653454cdc8bdd3cc4

General

Target
2026-09-12_68f4bcdca32a18b933558979625a255d_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
Size 6.1MB
Sample260913-af35jszxbs
SHA256 e3a5431d09285e45c7dbf3bf8e19beafd6f6bd0ded078c3653454cdc8bdd3cc4
MD5 68f4bcdca32a18b933558979625a255d
SHA1 39fd1c27943d9737eed4aa04b20cdcde2babdf6d
SHA512 5b9189da5808804e9a91bd0e7ac274ce618fff659e43d32c8269d7aafb5bdd10abe37d4ce9dad28537e91fa9bd11283f79a3c5975c84fb53010fbc0e80743460
SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VQrFh9InYU3eQwgYwtH494y/QdAd:pWvSDzaxztQVQJ3InYwe/0w4yYd+
TLSH
T1CA56CF03FC9464A8D5E9F230CD7592627731B844473567E32B65AABB2A73BC49FB8340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-12_68f4bcdca32a18b933558979625a255d_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 6.1MB
- SHA256 e3a5431d09285e45c7dbf3bf8e19beafd6f6bd0ded078c3653454cdc8bdd3cc4
- MD5 68f4bcdca32a18b933558979625a255d
- SHA1 39fd1c27943d9737eed4aa04b20cdcde2babdf6d
- SHA512 5b9189da5808804e9a91bd0e7ac274ce618fff659e43d32c8269d7aafb5bdd10abe37d4ce9dad28537e91fa9bd11283f79a3c5975c84fb53010fbc0e80743460
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VQrFh9InYU3eQwgYwtH494y/QdAd:pWvSDzaxztQVQJ3InYwe/0w4yYd+
- TLSH
  T1CA56CF03FC9464A8D5E9F230CD7592627731B844473567E32B65AABB2A73BC49FB8340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery gofing ransomware spyware stealer persistence privilege_escalation
- Family: Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops Chrome extension
- Drops desktop.ini file(s)
behavioral1 behavioral2