gofing | f3397b4060048636465bfc1a83627ddf7e0b602375ecc9ba3660e5b417939303

General

Target
2026-10-02_5adbac220b90285affd7c5cdf7a45d38_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
Size 4.1MB
Sample261003-n8b4esda74
SHA256 f3397b4060048636465bfc1a83627ddf7e0b602375ecc9ba3660e5b417939303
MD5 5adbac220b90285affd7c5cdf7a45d38
SHA1 4e9c7d697f0e501a548967824d9a5cd496ab3a81
SHA512 47a43f50dcdce01c6db758be52a4789ecb59fb9e8e3b75e5b8c694cec7e48b3a5eb5d4425b329a50cb0b33e2575315558b31458157aff07de9943d8920e1c784
SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q40:ieF+iIAEl1JPz212IhzL+Bzz3dw/V2
TLSH
T1B5169D03FC9564A9C5E9F23089B583927B71B858473123D72F64ABBB2A777C41E78390
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-02_5adbac220b90285affd7c5cdf7a45d38_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 4.1MB
- SHA256 f3397b4060048636465bfc1a83627ddf7e0b602375ecc9ba3660e5b417939303
- MD5 5adbac220b90285affd7c5cdf7a45d38
- SHA1 4e9c7d697f0e501a548967824d9a5cd496ab3a81
- SHA512 47a43f50dcdce01c6db758be52a4789ecb59fb9e8e3b75e5b8c694cec7e48b3a5eb5d4425b329a50cb0b33e2575315558b31458157aff07de9943d8920e1c784
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q40:ieF+iIAEl1JPz212IhzL+Bzz3dw/V2
- TLSH
  T1B5169D03FC9564A9C5E9F23089B583927B71B858473123D72F64ABBB2A777C41E78390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery gofing persistence privilege_escalation ransomware spyware stealer
- Family: Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2