General
- Target 2026-10-09_463baa44f1f2107928bc0f25407e272d_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 4.1MB
- Sample261010-rcfzaaxt6q
- SHA256 3e2d266d4011ca632c81cbcbad6ff2ff39e8a0c35ed110a0bd4ef2d953548051
Score
10/10
Malware Config
Targets
-
- Target 2026-10-09_463baa44f1f2107928bc0f25407e272d_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 4.1MB
- SHA256 3e2d266d4011ca632c81cbcbad6ff2ff39e8a0c35ed110a0bd4ef2d953548051
Score10/10Family: Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
Renames multiple (55) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Drops Chrome extension
Drops desktop.ini file(s)
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1