gofing | 0e2c9e407df7772167d11afbe62deca329777cb36b0f0ad8b387b0365729060b

General

Target
2026-09-13_08ab03ab6263873a5f5a67e90c73119b_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
Size 17.4MB
Sample260913-wt3ltsbp2v
SHA256 0e2c9e407df7772167d11afbe62deca329777cb36b0f0ad8b387b0365729060b
MD5 08ab03ab6263873a5f5a67e90c73119b
SHA1 8d12dd68e87c92002c06c5105ca246b6935fb98b
SHA512 dc9a330b09a9fd668f46382419ffaa1ae8ae832e40286758b6ad758def064d55c8fb329a7d72cc46b3c786f463d7818f9e7c46f9bdeeaf01048398ae3ba48a38
SSDEEP 393216:8KVUn7sJsXoc+F10QdDmnKP/cCaV1Yj7Cgvm8m7pVc4Bhkk:8NsoylDkKRaQCgv0Pkk
TLSH
T1D1071203FC9524A9C5E9F2318AB593527A31B858473123D72F64ABBB2A737C41F78394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-13_08ab03ab6263873a5f5a67e90c73119b_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 17.4MB
- SHA256 0e2c9e407df7772167d11afbe62deca329777cb36b0f0ad8b387b0365729060b
- MD5 08ab03ab6263873a5f5a67e90c73119b
- SHA1 8d12dd68e87c92002c06c5105ca246b6935fb98b
- SHA512 dc9a330b09a9fd668f46382419ffaa1ae8ae832e40286758b6ad758def064d55c8fb329a7d72cc46b3c786f463d7818f9e7c46f9bdeeaf01048398ae3ba48a38
- SSDEEP 393216:8KVUn7sJsXoc+F10QdDmnKP/cCaV1Yj7Cgvm8m7pVc4Bhkk:8NsoylDkKRaQCgv0Pkk
- TLSH
  T1D1071203FC9524A9C5E9F2318AB593527A31B858473123D72F64ABBB2A737C41F78394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery gofing persistence privilege_escalation ransomware spyware stealer
- Family: Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2