gofing | bf7c2552bcbe9647dea63fbc09562848995b91d36c8bf90769c966ebe3b32b4e

General

Target
2026-09-16_3a21d6511c5f633ef17b5d0573219591_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
Size 17.4MB
Sample260916-ebenlsszhx
SHA256 bf7c2552bcbe9647dea63fbc09562848995b91d36c8bf90769c966ebe3b32b4e
MD5 3a21d6511c5f633ef17b5d0573219591
SHA1 dee5fdfc2c7ef18c5aa9c443f8217aadcc3ef342
SHA512 80b4056fe3a8f83b9b569c2d363ecdf833e5f488ee34e58824abbf7987ab1b14768c2f36d0c19e0901b54c48283784704286e6ec1f72d025964d0200a2d2886e
SSDEEP 393216:8KVvninx5bMh7wKc5ZFD/8QbBuZIMtjCAiqVTyG7bUsK7:8Iix5m7pYHDluZJtjCzqpHK
TLSH
T19F071203FC9520A9C6E9F23089B593927B717858473127D72F64ABBB2A737C41E78394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-16_3a21d6511c5f633ef17b5d0573219591_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 17.4MB
- SHA256 bf7c2552bcbe9647dea63fbc09562848995b91d36c8bf90769c966ebe3b32b4e
- MD5 3a21d6511c5f633ef17b5d0573219591
- SHA1 dee5fdfc2c7ef18c5aa9c443f8217aadcc3ef342
- SHA512 80b4056fe3a8f83b9b569c2d363ecdf833e5f488ee34e58824abbf7987ab1b14768c2f36d0c19e0901b54c48283784704286e6ec1f72d025964d0200a2d2886e
- SSDEEP 393216:8KVvninx5bMh7wKc5ZFD/8QbBuZIMtjCAiqVTyG7bUsK7:8Iix5m7pYHDluZJtjCzqpHK
- TLSH
  T19F071203FC9520A9C6E9F23089B593927B717858473127D72F64ABBB2A737C41E78394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery gofing persistence privilege_escalation ransomware spyware stealer
- Family: Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2