89 lines
2.7 KiB
Markdown
89 lines
2.7 KiB
Markdown
---
|
|
name: analyzing-golang-malware-internals
|
|
description: 'Analyzes Go-compiled malware by recovering function names from the pclntab, detecting
|
|
the Go build/version string, and listing embedded package paths to overcome stripped symbols.
|
|
Activates for requests to analyze Go malware, recover Go function names, or identify a Golang
|
|
binary build.'
|
|
domain: cybersecurity
|
|
subdomain: reverse-engineering
|
|
tags:
|
|
- reverse-engineering
|
|
- golang
|
|
- symbol-recovery
|
|
- pclntab
|
|
- stripped-binaries
|
|
version: 1.0.0
|
|
author: analyst-ai-pack
|
|
license: Apache-2.0
|
|
mitre_attack:
|
|
- T1027
|
|
- T1587.001
|
|
- T1059
|
|
d3fend:
|
|
- D3-SDA
|
|
- D3-DA
|
|
references:
|
|
- 'Go runtime pclntab format (Go source: runtime/symtab.go) — https://go.dev/src/runtime/symtab.go'
|
|
- 'Go binary build info (debug/buildinfo) — https://pkg.go.dev/debug/buildinfo'
|
|
---
|
|
|
|
# Analyzing Golang Malware Internals
|
|
|
|
## When to Use
|
|
|
|
- You have a Go-compiled binary (often large, statically linked) and standard symbol recovery
|
|
fails because user symbols are stripped.
|
|
- You need function names from the pclntab, the Go version, and embedded package/module paths.
|
|
|
|
**Do not use** this for non-Go binaries — confirm the Go build signature first. This skill reads
|
|
the binary statically and executes nothing.
|
|
|
|
## Prerequisites
|
|
|
|
- The Go binary (read inertly).
|
|
|
|
## Safety & Handling
|
|
|
|
- Read bytes statically; treat strings as untrusted data.
|
|
|
|
## Workflow
|
|
|
|
### Step 1: Confirm it is Go and get the version
|
|
|
|
```bash
|
|
python scripts/analyst.py info sample.bin
|
|
```
|
|
|
|
Looks for the `Go build ID`, the `go1.x` version string, and `runtime.` references.
|
|
|
|
### Step 2: Recover function names from pclntab
|
|
|
|
The pclntab (preceded by a magic like `\xfb\xff\xff\xff`/`\xf0\xff\xff\xff` across Go versions)
|
|
contains function name strings; extract `main.*`, package-qualified, and `runtime.*` names.
|
|
|
|
### Step 3: Enumerate package paths
|
|
|
|
List embedded import/module paths (`github.com/...`, vendored deps) to fingerprint capabilities
|
|
and third-party libraries.
|
|
|
|
### Step 4: Map and document
|
|
|
|
Map suspicious packages (networking, crypto, exec) to behavior and ATT&CK.
|
|
|
|
## Validation
|
|
|
|
- The Go build signature/version is confirmed before deeper parsing.
|
|
- Recovered names include plausible `main.*`/package-qualified functions.
|
|
- Package paths are real module paths, not random strings.
|
|
|
|
## Pitfalls
|
|
|
|
- pclntab magic differs across Go versions; try the known set.
|
|
- Obfuscators (garble) rename symbols and strip build info — names may be hashed.
|
|
- Confusing vendored library code with the author's `main` package.
|
|
|
|
## References
|
|
|
|
- See [`references/api-reference.md`](references/api-reference.md) for the analyzer.
|
|
- Go pclntab/buildinfo references (linked in frontmatter).
|