General
- Target 2026-10-11_b193181f5f418032fa0b91dbb5c82425_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 4.1MB
- Sample261012-p8pvysda62
- SHA256 78c1c0a1074bd803de6997813faedcb0813de74fc465da643ff0a9cd54531873
Score
10/10
Malware Config
Targets
-
- Target 2026-10-11_b193181f5f418032fa0b91dbb5c82425_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hive_luca-stealer_salatstealer_sliver_snatch
- Size 4.1MB
- SHA256 78c1c0a1074bd803de6997813faedcb0813de74fc465da643ff0a9cd54531873
Score10/10Family: Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Drops Chrome extension
Drops desktop.ini file(s)
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1