gofing | b342605eaa2275385942200f49c903f1a3cb7801c63267da88d99681295ce104

General

Target
2026-09-12_418989a6e8cce047dceb501ac134880a_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
Size 6.1MB
Sample260913-de6qtszhph
SHA256 b342605eaa2275385942200f49c903f1a3cb7801c63267da88d99681295ce104
MD5 418989a6e8cce047dceb501ac134880a
SHA1 24dfca73fedf057289fbd1ed5ca610d5d5b03e81
SHA512 e07f02d1ef635e98abd049ee131db5ded442d996b71c1afd6428d7a84ea66fef48b4a24532ab633d58820ae283d09b4bc0e205c12c9ea9360732c4eea5958186
SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VOUqT+SWm/UYB0U6znOCtFvI8V64:pWvSDzaxztQVPqibmc66znOCt9Imb
TLSH
T13856CF03FC9990A8C5E9F530C96593927A3178544B31A3D32BA4EBBB2A777C41E7D390
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-12_418989a6e8cce047dceb501ac134880a_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 6.1MB
- SHA256 b342605eaa2275385942200f49c903f1a3cb7801c63267da88d99681295ce104
- MD5 418989a6e8cce047dceb501ac134880a
- SHA1 24dfca73fedf057289fbd1ed5ca610d5d5b03e81
- SHA512 e07f02d1ef635e98abd049ee131db5ded442d996b71c1afd6428d7a84ea66fef48b4a24532ab633d58820ae283d09b4bc0e205c12c9ea9360732c4eea5958186
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VOUqT+SWm/UYB0U6znOCtFvI8V64:pWvSDzaxztQVPqibmc66znOCt9Imb
- TLSH
  T13856CF03FC9990A8C5E9F530C96593927A3178544B31A3D32BA4EBBB2A777C41E7D390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

gofing ransomware credential_access discovery persistence privilege_escalation spyware stealer
- Family: Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2