SYMBOLCOMMON_NAMEaka. SYNONYMS
win.gofing (Back to overview)

Gofing

aka: Velocity Polymorphic Compression Malware

A file infector written in Go, discovered by Karsten Hahn in February 2022. According to Karsten, despite its internal naming, it is not polymorphic and the virus body is not encrypted. Gofing uses the Coldfire Golang malware development library.

References
2022-02-28 ⋅ Twitter (@struppigel) ⋅ Karsten Hahn
Tweet on Gofing discovery
Gofing

There is no Yara-Signature yet.