gofing | e9e6755442556ed142a0cb5576ee7b560d273e088c5d277c270acbd911e4389e

General

Target
2026-09-12_0a84541e71cab7a9c7ad523b4a37b18f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
Size 17.4MB
Sample260913-hndhvsgc76
SHA256 e9e6755442556ed142a0cb5576ee7b560d273e088c5d277c270acbd911e4389e
MD5 0a84541e71cab7a9c7ad523b4a37b18f
SHA1 94ba610fda948f86064d1de134e708630b8489fa
SHA512 9d57f9d8dd6fca1dbcf13896292b45e8919a1c7782c136d07bdbe0d1faa7af028bd660e51b591187effd8b2012bc0296c83b1f17ee27a57006d52550954774b2
SSDEEP 393216:8KViPI/PVA5bYNnbLA1j1NwKIuAY3lP53q:8nIVARGb81jTwilP56
TLSH
T1E4071203FC9564E8C5E9F2318A7583927B31B859473167D32F64AABB2A737C41E78390
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-12_0a84541e71cab7a9c7ad523b4a37b18f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 17.4MB
- SHA256 e9e6755442556ed142a0cb5576ee7b560d273e088c5d277c270acbd911e4389e
- MD5 0a84541e71cab7a9c7ad523b4a37b18f
- SHA1 94ba610fda948f86064d1de134e708630b8489fa
- SHA512 9d57f9d8dd6fca1dbcf13896292b45e8919a1c7782c136d07bdbe0d1faa7af028bd660e51b591187effd8b2012bc0296c83b1f17ee27a57006d52550954774b2
- SSDEEP 393216:8KViPI/PVA5bYNnbLA1j1NwKIuAY3lP53q:8nIVARGb81jTwilP56
- TLSH
  T1E4071203FC9564E8C5E9F2318A7583927B31B859473167D32F64AABB2A737C41E78390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery gofing persistence privilege_escalation ransomware spyware stealer
- Family: Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2