gofing | 9471a893c7ea7d37b66a90d5245dd9b5fd29ba9c3dacd241ba0fc484de991d35

General

Target
2026-09-13_9736174f8854dd5f499a836cab89b8cb_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
Size 17.4MB
Sample260913-ph8kdawhrf
SHA256 9471a893c7ea7d37b66a90d5245dd9b5fd29ba9c3dacd241ba0fc484de991d35
MD5 9736174f8854dd5f499a836cab89b8cb
SHA1 90a5277ecc8957ce80dd16562544a5e8ccc64c9b
SHA512 c23f5aae939cc33f9b7316ebe54ae6499dcbfde9f0887bfd0ed45314acfcfaa84fc1d3e06ffa1761de0067158516f1f8bfdb43995edbf7991201e78443f2782e
SSDEEP 393216:8KVEP/we+HKC3F0/4VCIl2u1XqcJ6GNsXOqal:8DP/we8WgVCIbJhNseqal
TLSH
T1B0071203FC9564A9C5E9F230897983927B71B858473127D32B64ABBB2A737C45F78390
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-13_9736174f8854dd5f499a836cab89b8cb_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 17.4MB
- SHA256 9471a893c7ea7d37b66a90d5245dd9b5fd29ba9c3dacd241ba0fc484de991d35
- MD5 9736174f8854dd5f499a836cab89b8cb
- SHA1 90a5277ecc8957ce80dd16562544a5e8ccc64c9b
- SHA512 c23f5aae939cc33f9b7316ebe54ae6499dcbfde9f0887bfd0ed45314acfcfaa84fc1d3e06ffa1761de0067158516f1f8bfdb43995edbf7991201e78443f2782e
- SSDEEP 393216:8KVEP/we+HKC3F0/4VCIl2u1XqcJ6GNsXOqal:8DP/we8WgVCIbJhNseqal
- TLSH
  T1B0071203FC9564A9C5E9F230897983927B71B858473127D32B64ABBB2A737C45F78390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery gofing persistence privilege_escalation ransomware spyware stealer
- Family: Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Renames multiple (60) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops Chrome extension
- Drops desktop.ini file(s)
behavioral1 behavioral2