1

I have been trying to understand the working of this go malware by reversing it, which can be found here , so basically this stuff takes a shellcode as an input, and converts it to an exe or dll file, turns out the exe generated is a go file which obfuscates most of the functions using garble[which is a code obfuscator written in go], so the main challenge over here is to understand or look for the subroutine, which is either encoding/obfuscating the function names and other identifiers with base64 encoding, one of the challenge garble presents is the obfuscator hooks directly into 'go build' via its -toolexec flag . I am attaching the link to binary along with some of the screenshots which can bring more context to my current problem, in case I missed something, my apologies.

Link to binary : https://easyupload.io/xcqeod

Screenshots :

Garble obfuscated malware functions functions

1
  • The binary is 404, possibly because it's malware. Oct 10, 2022 at 7:22

1 Answer 1

0

Unable to restore function names because they were obscured (renamed with trash names) at source level. I believe most of these functions are trash dummy functions without any useful logic. To understand the activity of this binary is to run in any sandbox with logging.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.