gofing | e241f860cd39adc44f1fbff6540d08e6d627b944fa5f232cb013d87f3a00221b

General

Target
2026-09-17_c6e8cdbffd46ccc1a373c2cd45e5c50a_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
Size 6.1MB
Sample260917-tr6vcsgc86
SHA256 e241f860cd39adc44f1fbff6540d08e6d627b944fa5f232cb013d87f3a00221b
MD5 c6e8cdbffd46ccc1a373c2cd45e5c50a
SHA1 ebd81d5965bc0bd3f8412338fd2785d0fd254064
SHA512 b4e6eeb0ce56171d297211e9f5de3f8134e2a60e4fcc8348aa0caf06fec94b7385a5146ecc7f1359882f007fa18c3eda1863ff95dea9d91a175ba2309126f4b6
SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VRATq7ZuGNN66rDLruuTYxqzk:pWvSDzaxztQVRATTGNHHuuTYl
TLSH
T14556CF03FCA524A9D9E9F2708A75925277717849073123D76B60BBBB2BB37C41E78390
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-17_c6e8cdbffd46ccc1a373c2cd45e5c50a_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 6.1MB
- SHA256 e241f860cd39adc44f1fbff6540d08e6d627b944fa5f232cb013d87f3a00221b
- MD5 c6e8cdbffd46ccc1a373c2cd45e5c50a
- SHA1 ebd81d5965bc0bd3f8412338fd2785d0fd254064
- SHA512 b4e6eeb0ce56171d297211e9f5de3f8134e2a60e4fcc8348aa0caf06fec94b7385a5146ecc7f1359882f007fa18c3eda1863ff95dea9d91a175ba2309126f4b6
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VRATq7ZuGNN66rDLruuTYxqzk:pWvSDzaxztQVRATTGNHHuuTYl
- TLSH
  T14556CF03FCA524A9D9E9F2708A75925277717849073123D76B60BBBB2BB37C41E78390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery gofing persistence privilege_escalation ransomware spyware stealer
- Family: Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2