gofing | 1229ba8e348cbc4119b4ebfb73570df13008dc02ed2215a47171103c58d8c7af

General

Target
2026-10-05_3ba0a892336baea99dcc403ae544843b_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
Size 7.1MB
Sample261007-cv7gmacs8n
SHA256 1229ba8e348cbc4119b4ebfb73570df13008dc02ed2215a47171103c58d8c7af
MD5 3ba0a892336baea99dcc403ae544843b
SHA1 45a52c09143780e848fa6afe64bef2bd92cae330
SHA512 de4034113855d74cd50c05d6d4d455f61a8f187a6378c64a448f4927419fd4f26d05f4518d19b87876e6db6c9fc5c0a347e56dd827d406df38c9fe83c18203a2
SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VdDnp/EZ+t/N7X1CGJYw57HLkrr:pWvSDzaxztQVd7p/EgVhYwJHorr
TLSH
T1D676D003FC9564A9C5E9F23089B993927B71B858473123D32B64A6BB2B737C41F78394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-05_3ba0a892336baea99dcc403ae544843b_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 7.1MB
- SHA256 1229ba8e348cbc4119b4ebfb73570df13008dc02ed2215a47171103c58d8c7af
- MD5 3ba0a892336baea99dcc403ae544843b
- SHA1 45a52c09143780e848fa6afe64bef2bd92cae330
- SHA512 de4034113855d74cd50c05d6d4d455f61a8f187a6378c64a448f4927419fd4f26d05f4518d19b87876e6db6c9fc5c0a347e56dd827d406df38c9fe83c18203a2
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VdDnp/EZ+t/N7X1CGJYw57HLkrr:pWvSDzaxztQVd7p/EgVhYwJHorr
- TLSH
  T1D676D003FC9564A9C5E9F23089B993927B71B858473123D32B64A6BB2B737C41F78394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery gofing persistence privilege_escalation ransomware spyware stealer
- Family: Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2