gofing | 8e4b87b5e877517b17666d0067e6e63cbea89da84a25a2a9e2f8b1586d1cccb5

General

Target
2026-09-12_4422f2145f9c6833ac27c61ff72340da_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
Size 7.8MB
Sample260913-c8243abm5w
SHA256 8e4b87b5e877517b17666d0067e6e63cbea89da84a25a2a9e2f8b1586d1cccb5
MD5 4422f2145f9c6833ac27c61ff72340da
SHA1 09592c42074a050acf9dc5209aebff7bca4c2612
SHA512 bc1690e0723b1a8a980ba59cff596ac41b1dfb04a847a62db63977fb2da3abdf9d12f6377f8f35139019ed6e53b5fa3942968a26e3a40b3b0ceebe85616cc511
SSDEEP 196608:pWvSDzaxztQVwCZnFKmGaui9rfUc7/GUZCkaJ:8KVbZnopCr8cOUskaJ
TLSH
T14586E003FC9554E9C6E9F23089B582927A30B859433137D72F60AABB2E777D45E78390
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-12_4422f2145f9c6833ac27c61ff72340da_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 7.8MB
- SHA256 8e4b87b5e877517b17666d0067e6e63cbea89da84a25a2a9e2f8b1586d1cccb5
- MD5 4422f2145f9c6833ac27c61ff72340da
- SHA1 09592c42074a050acf9dc5209aebff7bca4c2612
- SHA512 bc1690e0723b1a8a980ba59cff596ac41b1dfb04a847a62db63977fb2da3abdf9d12f6377f8f35139019ed6e53b5fa3942968a26e3a40b3b0ceebe85616cc511
- SSDEEP 196608:pWvSDzaxztQVwCZnFKmGaui9rfUc7/GUZCkaJ:8KVbZnopCr8cOUskaJ
- TLSH
  T14586E003FC9554E9C6E9F23089B582927A30B859433137D72F60AABB2E777D45E78390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access gofing ransomware stealer discovery persistence privilege_escalation spyware
- Family: Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2