gofing | 8c17d643bf4b19993640f8fad5e6db4e237d57232a336b9a40df992faabb1430

General

Target
2026-09-16_7df6def5a77e21da7f64a0d4dbda8414_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
Size 17.4MB
Sample260916-d5f8vsszev
SHA256 8c17d643bf4b19993640f8fad5e6db4e237d57232a336b9a40df992faabb1430
MD5 7df6def5a77e21da7f64a0d4dbda8414
SHA1 52b5bbc1b23cb5739299ad75c84fb46147727eca
SHA512 392bd95de3e440e84b19aa708ff11dd03409b7a1f352aa33f9722320f82c436a2d9fca7637dbf71bb92211c9ddb62ea0492ff2e538924db7071d12b868415f79
SSDEEP 393216:8KVuP6l9HkDOCf1rwsfJbtzBKnKAvkNXSiQfJjE:8JQ9xCF7fZtzAnKAYNcJE
TLSH
T13E071203FC9564A9C5E9F23089B983927B717859473123D72B64A7BB2B73BC41E78390
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-16_7df6def5a77e21da7f64a0d4dbda8414_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 17.4MB
- SHA256 8c17d643bf4b19993640f8fad5e6db4e237d57232a336b9a40df992faabb1430
- MD5 7df6def5a77e21da7f64a0d4dbda8414
- SHA1 52b5bbc1b23cb5739299ad75c84fb46147727eca
- SHA512 392bd95de3e440e84b19aa708ff11dd03409b7a1f352aa33f9722320f82c436a2d9fca7637dbf71bb92211c9ddb62ea0492ff2e538924db7071d12b868415f79
- SSDEEP 393216:8KVuP6l9HkDOCf1rwsfJbtzBKnKAvkNXSiQfJjE:8JQ9xCF7fZtzAnKAYNcJE
- TLSH
  T13E071203FC9564A9C5E9F23089B983927B717859473123D72B64A7BB2B73BC41E78390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery gofing persistence privilege_escalation ransomware spyware stealer
- Family: Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2