gofing | d1cbead30c249562c3c0b2194b48545676924a4670b942b7ce51f16fe201a8ab

General

Target
2026-09-12_4f73e780dac7ceb5694e36d294947206_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
Size 7.8MB
Sample260913-cfrsmazdle
SHA256 d1cbead30c249562c3c0b2194b48545676924a4670b942b7ce51f16fe201a8ab
MD5 4f73e780dac7ceb5694e36d294947206
SHA1 562300813a82ad03ef27899d0271fef27526bebf
SHA512 33824c64a57ad3ef5eb1b2a141cb709d9fc63c325d4dc24464b695e3442e8ec85f0bdc4b55c626287f8287a505aacea9d46d48ff6cd04c6f1609db9f57f12887
SSDEEP 196608:pWvSDzaxztQVHU1W7TDacMbllw4d89Xft:8KVxnolmZ1
TLSH
T1FB86E003FC9964B8C5E9F230C97583527A717898473127D72BA0AABB2E777C41E78394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-12_4f73e780dac7ceb5694e36d294947206_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 7.8MB
- SHA256 d1cbead30c249562c3c0b2194b48545676924a4670b942b7ce51f16fe201a8ab
- MD5 4f73e780dac7ceb5694e36d294947206
- SHA1 562300813a82ad03ef27899d0271fef27526bebf
- SHA512 33824c64a57ad3ef5eb1b2a141cb709d9fc63c325d4dc24464b695e3442e8ec85f0bdc4b55c626287f8287a505aacea9d46d48ff6cd04c6f1609db9f57f12887
- SSDEEP 196608:pWvSDzaxztQVHU1W7TDacMbllw4d89Xft:8KVxnolmZ1
- TLSH
  T1FB86E003FC9964B8C5E9F230C97583527A717898473127D72BA0AABB2E777C41E78394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

gofing ransomware credential_access discovery persistence privilege_escalation spyware stealer
- Family: Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2