gofing | 2c45db9d8f6216ad53dfadcf9e4418f38956043ac5d0632c993694075de25192

General

Target
2026-09-13_b6a875aa54c8750e61a4f41f27075549_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
Size 7.9MB
Sample260913-m7ex9aac82
SHA256 2c45db9d8f6216ad53dfadcf9e4418f38956043ac5d0632c993694075de25192
MD5 b6a875aa54c8750e61a4f41f27075549
SHA1 93b94ab0694f41d33884c83fc13b588223e72c92
SHA512 9facba0582c9d40ae09409f505995ca2ded2755de8e78a6054dc7a64f099d78f4e58405fd0a7d87225cf742b7fac34fbe290af6207c59599f2d475d8f45d62f8
SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VtqBtsk/OFIAUSAbAlu7AAH0ReP8Df2CR8xa:pWvSDzaxztQVgsuAg8YLseCCxTAckV
TLSH
T1A586E003FC9564A9C5E9F23089B583A27B717858473123D72F64ABBB2A777C41E78390
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-13_b6a875aa54c8750e61a4f41f27075549_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 7.9MB
- SHA256 2c45db9d8f6216ad53dfadcf9e4418f38956043ac5d0632c993694075de25192
- MD5 b6a875aa54c8750e61a4f41f27075549
- SHA1 93b94ab0694f41d33884c83fc13b588223e72c92
- SHA512 9facba0582c9d40ae09409f505995ca2ded2755de8e78a6054dc7a64f099d78f4e58405fd0a7d87225cf742b7fac34fbe290af6207c59599f2d475d8f45d62f8
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VtqBtsk/OFIAUSAbAlu7AAH0ReP8Df2CR8xa:pWvSDzaxztQVgsuAg8YLseCCxTAckV
- TLSH
  T1A586E003FC9564A9C5E9F23089B583A27B717858473123D72F64ABBB2A777C41E78390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access gofing ransomware stealer discovery persistence privilege_escalation spyware
- Family: Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2