gofing | 41aa72d8df98581faa6ae07ca01d8b3a81d99f867915e9fae7351d2953c266eb

General

Target
2026-09-12_383333954c2b57a3d38e23214a3bb820_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
Size 6.5MB
Sample260913-d28tpss1cz
SHA256 41aa72d8df98581faa6ae07ca01d8b3a81d99f867915e9fae7351d2953c266eb
MD5 383333954c2b57a3d38e23214a3bb820
SHA1 164554eff0e28b66a9b921363430f6ac9fca2aab
SHA512 c53cd22e59e9e27e053f544247cbce8367eaddd8ea33929e36d84532c55e928a17822294063e02573a75f05c2e1e450a113ec66e7359d5e4111a144482bf2023
SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VD87Y5FeXJD2KzxGJttgTK7:pWvSDzaxztQVDiY5FCGKTu
TLSH
T1BB66CF03FC9564A9C5E9F230CA7983927B717858473123D72F64AABB2A777C41E78390
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-12_383333954c2b57a3d38e23214a3bb820_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 6.5MB
- SHA256 41aa72d8df98581faa6ae07ca01d8b3a81d99f867915e9fae7351d2953c266eb
- MD5 383333954c2b57a3d38e23214a3bb820
- SHA1 164554eff0e28b66a9b921363430f6ac9fca2aab
- SHA512 c53cd22e59e9e27e053f544247cbce8367eaddd8ea33929e36d84532c55e928a17822294063e02573a75f05c2e1e450a113ec66e7359d5e4111a144482bf2023
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VD87Y5FeXJD2KzxGJttgTK7:pWvSDzaxztQVDiY5FCGKTu
- TLSH
  T1BB66CF03FC9564A9C5E9F230CA7983927B717858473123D72F64AABB2A777C41E78390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

gofing ransomware credential_access discovery persistence privilege_escalation spyware stealer
- Family: Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2