gofing | bb64293e5bc4e8705f6f649607bb311ecd71429ddfbcedecb82dbdeb4c3ccb72

General

Target
2026-09-12_37be06688ae2608f7e8b2a8c9a0b2b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
Size 4.6MB
Sample260913-d3yecsee86
SHA256 bb64293e5bc4e8705f6f649607bb311ecd71429ddfbcedecb82dbdeb4c3ccb72
MD5 37be06688ae2608f7e8b2a8c9a0b2b10
SHA1 9c9291fffc49763d606e5fc1c68009bdb4f8c672
SHA512 350e4551d00e9102ffb04d8c9e0eece3158cd5ce8da4e99d8946f8e1d8e224335913447ccff913212cf23ab63c8c8e41af972bcc06c6451183d2c5a5ca67c9ab
SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VpJQE:pWvSDzaxztQVnQE
TLSH
T130269D03FC9524A8C5E9F230C96A83527B717C59473223D72F64AABB2A73BD41E78354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-12_37be06688ae2608f7e8b2a8c9a0b2b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 4.6MB
- SHA256 bb64293e5bc4e8705f6f649607bb311ecd71429ddfbcedecb82dbdeb4c3ccb72
- MD5 37be06688ae2608f7e8b2a8c9a0b2b10
- SHA1 9c9291fffc49763d606e5fc1c68009bdb4f8c672
- SHA512 350e4551d00e9102ffb04d8c9e0eece3158cd5ce8da4e99d8946f8e1d8e224335913447ccff913212cf23ab63c8c8e41af972bcc06c6451183d2c5a5ca67c9ab
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VpJQE:pWvSDzaxztQVnQE
- TLSH
  T130269D03FC9524A8C5E9F230C96A83527B717C59473223D72F64AABB2A73BD41E78354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery gofing persistence privilege_escalation ransomware spyware stealer
- Family: Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2