gofing | eaaca74b7b4b10042e6286b42e7bad9730ed84e2c78ceb3fc397e4730854a3c1

General

Target
2026-09-13_f28874cebaa978f43c9189fdff4c9ae1_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
Size 14.5MB
Sample260913-kfglnahc73
SHA256 eaaca74b7b4b10042e6286b42e7bad9730ed84e2c78ceb3fc397e4730854a3c1
MD5 f28874cebaa978f43c9189fdff4c9ae1
SHA1 9120025bef5bc291199a8d6e629200693e35c704
SHA512 b684a0a0025929591f641475c903da1ad9479e693c5acefc58e99527e0fca7e8f9a684736f528e85f88e2a89311f58553224dcbf8b3de5029cfb9dc288fd3868
SSDEEP 393216:8KVtZE/GexT5zAvHTiqLzY4/rnX22ylJm4GrUSG/:8jh50vzlL0yXFaRGASG/
TLSH
T1CAE60203FC9564A9C5E9F230897982927B717858473127D32F64EBBB2A77BC41E78390
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-13_f28874cebaa978f43c9189fdff4c9ae1_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 14.5MB
- SHA256 eaaca74b7b4b10042e6286b42e7bad9730ed84e2c78ceb3fc397e4730854a3c1
- MD5 f28874cebaa978f43c9189fdff4c9ae1
- SHA1 9120025bef5bc291199a8d6e629200693e35c704
- SHA512 b684a0a0025929591f641475c903da1ad9479e693c5acefc58e99527e0fca7e8f9a684736f528e85f88e2a89311f58553224dcbf8b3de5029cfb9dc288fd3868
- SSDEEP 393216:8KVtZE/GexT5zAvHTiqLzY4/rnX22ylJm4GrUSG/:8jh50vzlL0yXFaRGASG/
- TLSH
  T1CAE60203FC9564A9C5E9F230897982927B717858473127D32F64EBBB2A77BC41E78390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery gofing persistence privilege_escalation ransomware spyware stealer
- Family: Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2