gofing | aac0d29a48941c9a75bdef627beaea894f4db5e69162391e22863035108b73f1

General

Target
2026-09-16_0757293353955cb6d521ad51402225ca_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
Size 6.3MB
Sample260916-eknymss1dt
SHA256 aac0d29a48941c9a75bdef627beaea894f4db5e69162391e22863035108b73f1
MD5 0757293353955cb6d521ad51402225ca
SHA1 af382f59c0acf29cccebac3a6fbfa1ad32e79598
SHA512 08e89bd341010058083ae050d37b945b00d9ee632e35227e371ff9a7586104b299b5bc05e1b62be19f3aaaf1c4a58f371da51f11ae6875b1abc33ae35937c2d5
SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VbAD143yznZ9pOHdDL:pWvSDzaxztQVPiznZzOH1
TLSH
T1A066AE63BD9862A8C5D9A33185758651FB21B87C673563C33F1097BB6A37FC06A39380
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-16_0757293353955cb6d521ad51402225ca_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 6.3MB
- SHA256 aac0d29a48941c9a75bdef627beaea894f4db5e69162391e22863035108b73f1
- MD5 0757293353955cb6d521ad51402225ca
- SHA1 af382f59c0acf29cccebac3a6fbfa1ad32e79598
- SHA512 08e89bd341010058083ae050d37b945b00d9ee632e35227e371ff9a7586104b299b5bc05e1b62be19f3aaaf1c4a58f371da51f11ae6875b1abc33ae35937c2d5
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VbAD143yznZ9pOHdDL:pWvSDzaxztQVPiznZzOH1
- TLSH
  T1A066AE63BD9862A8C5D9A33185758651FB21B87C673563C33F1097BB6A37FC06A39380
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery gofing persistence privilege_escalation ransomware spyware stealer
- Family: Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2