gofing | 34dbbeb98b0fc04e5f41090fac8a6b9f3b104be46c230d67600967eca3fb9351

General

Target
2026-09-17_589d3ca2e9f4f7fd13ff94d3d3d6f406_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
Size 5.9MB
Sample260917-ylkr6abd98
SHA256 34dbbeb98b0fc04e5f41090fac8a6b9f3b104be46c230d67600967eca3fb9351
MD5 589d3ca2e9f4f7fd13ff94d3d3d6f406
SHA1 5eb64af6937177c8d5b905989e8b9b375655705f
SHA512 ccda9234a0bc1daa439cb2d63aa3b2d26509604383652dd53d0b68bf20798de31aeaa8070919ee9139d7ee11c1d403751f9c3c716e5e256eefe952f25c33b1b9
SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VjapB9QyBXdWkl7h:pWvSDzaxztQVybjoe
TLSH
T19856BE13BC9495B8D5EEF23289B982927774B854033123D32F65E7BB2A727C81E79740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-17_589d3ca2e9f4f7fd13ff94d3d3d6f406_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 5.9MB
- SHA256 34dbbeb98b0fc04e5f41090fac8a6b9f3b104be46c230d67600967eca3fb9351
- MD5 589d3ca2e9f4f7fd13ff94d3d3d6f406
- SHA1 5eb64af6937177c8d5b905989e8b9b375655705f
- SHA512 ccda9234a0bc1daa439cb2d63aa3b2d26509604383652dd53d0b68bf20798de31aeaa8070919ee9139d7ee11c1d403751f9c3c716e5e256eefe952f25c33b1b9
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VjapB9QyBXdWkl7h:pWvSDzaxztQVybjoe
- TLSH
  T19856BE13BC9495B8D5EEF23289B982927774B854033123D32F65E7BB2A727C81E79740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery gofing persistence privilege_escalation ransomware spyware stealer
- Family: Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2