gofing | ffffb28b20c5dc2869bf9214335d465179e4cde8872770757bf165c8531de294

General

Target
2026-09-12_1b3e0f65ea75419b82ac1a4661c720cb_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
Size 14.5MB
Sample260913-gb33bafe56
SHA256 ffffb28b20c5dc2869bf9214335d465179e4cde8872770757bf165c8531de294
MD5 1b3e0f65ea75419b82ac1a4661c720cb
SHA1 24f3c9aa7fda1e882b978da3e622718371a93da3
SHA512 17d20a150bbc06707b8c167e02a5708ca8c7babb53cde38b23645dfc0e680765795fd9c0844fe2c8a76820b9cc20c124a32078e49f22e7e364233b743c1d2613
SSDEEP 196608:pWvSDzaxztQVjxgw51FoLa4X+c9QydkP6OqI8uAyug1PAT1qo78B3KCtYyWh8AZm:8KV5xgwW7uc964zyrATF86CyyC8AQ
TLSH
T1DDE60203FC9564A8C5E9F23189B593927B71B858473163D32F64ABBB2A737C41E78390
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-12_1b3e0f65ea75419b82ac1a4661c720cb_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 14.5MB
- SHA256 ffffb28b20c5dc2869bf9214335d465179e4cde8872770757bf165c8531de294
- MD5 1b3e0f65ea75419b82ac1a4661c720cb
- SHA1 24f3c9aa7fda1e882b978da3e622718371a93da3
- SHA512 17d20a150bbc06707b8c167e02a5708ca8c7babb53cde38b23645dfc0e680765795fd9c0844fe2c8a76820b9cc20c124a32078e49f22e7e364233b743c1d2613
- SSDEEP 196608:pWvSDzaxztQVjxgw51FoLa4X+c9QydkP6OqI8uAyug1PAT1qo78B3KCtYyWh8AZm:8KV5xgwW7uc964zyrATF86CyyC8AQ
- TLSH
  T1DDE60203FC9564A8C5E9F23189B593927B71B858473163D32F64ABBB2A737C41E78390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access gofing ransomware stealer discovery persistence privilege_escalation spyware
- Family: Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2