gofing | d5d323365c428398930535601afa959edee7a8355854b964c6728204915cd3b1

General

Target
2026-09-16_ae1bfae2de5556c2a27a32e2c8d5e809_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
Size 14.5MB
Sample260916-lwebxahq7v
SHA256 d5d323365c428398930535601afa959edee7a8355854b964c6728204915cd3b1
MD5 ae1bfae2de5556c2a27a32e2c8d5e809
SHA1 286c9c551b9ed2120890ee5d0d7b9c96964c28a7
SHA512 f3b8f1ee202a44e0fe73c742ccbd319845e96b192a2898a802a588ea54fd55bb3ec273989fee2e16f2d4ef916a5bf9250094babf94341aa26e2e3607ef17ce22
SSDEEP 196608:pWvSDzaxztQVUKXbC6e7okkPouNIg8qIaZfa1qjWLnw2vkLZZ1U8rKdDK5l+UFfh:8KVnbCBMkSoAIgF7j8NkQ8vF5EM9x
TLSH
T158E61203FC9564B9C5EAF2308A7583927631B858473167D32F64AABB2A737C41F78394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-16_ae1bfae2de5556c2a27a32e2c8d5e809_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 14.5MB
- SHA256 d5d323365c428398930535601afa959edee7a8355854b964c6728204915cd3b1
- MD5 ae1bfae2de5556c2a27a32e2c8d5e809
- SHA1 286c9c551b9ed2120890ee5d0d7b9c96964c28a7
- SHA512 f3b8f1ee202a44e0fe73c742ccbd319845e96b192a2898a802a588ea54fd55bb3ec273989fee2e16f2d4ef916a5bf9250094babf94341aa26e2e3607ef17ce22
- SSDEEP 196608:pWvSDzaxztQVUKXbC6e7okkPouNIg8qIaZfa1qjWLnw2vkLZZ1U8rKdDK5l+UFfh:8KVnbCBMkSoAIgF7j8NkQ8vF5EM9x
- TLSH
  T158E61203FC9564B9C5EAF2308A7583927631B858473167D32F64AABB2A737C41F78394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery gofing persistence privilege_escalation ransomware spyware stealer
- Family: Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops Chrome extension
- Drops desktop.ini file(s)
behavioral1 behavioral2