Analyzing Golang Malware Internals

---
name: analyzing-golang-malware-internals
description: 'Analyzes Go-compiled malware by recovering function names from the pclntab, detecting
  the Go build/version string, and listing embedded package paths to overcome stripped symbols.
  Activates for requests to analyze Go malware, recover Go function names, or identify a Golang
  binary build.'
domain: cybersecurity
subdomain: reverse-engineering
tags:
  - reverse-engineering
  - golang
  - symbol-recovery
  - pclntab
  - stripped-binaries
version: 1.0.0
author: analyst-ai-pack
license: Apache-2.0
mitre_attack:
  - T1027
  - T1587.001
  - T1059
d3fend:
  - D3-SDA
  - D3-DA
references:
  - 'Go runtime pclntab format (Go source: runtime/symtab.go) — https://go.dev/src/runtime/symtab.go'
  - 'Go binary build info (debug/buildinfo) — https://pkg.go.dev/debug/buildinfo'
---

# Analyzing Golang Malware Internals

## When to Use

- You have a Go-compiled binary (often large, statically linked) and standard symbol recovery
  fails because user symbols are stripped.
- You need function names from the pclntab, the Go version, and embedded package/module paths.

**Do not use** this for non-Go binaries — confirm the Go build signature first. This skill reads
the binary statically and executes nothing.

## Prerequisites

- The Go binary (read inertly).

## Safety & Handling

- Read bytes statically; treat strings as untrusted data.

## Workflow

### Step 1: Confirm it is Go and get the version

```bash
python scripts/analyst.py info sample.bin
```

Looks for the `Go build ID`, the `go1.x` version string, and `runtime.` references.

### Step 2: Recover function names from pclntab

The pclntab (preceded by a magic like `\xfb\xff\xff\xff`/`\xf0\xff\xff\xff` across Go versions)
contains function name strings; extract `main.*`, package-qualified, and `runtime.*` names.

### Step 3: Enumerate package paths

List embedded import/module paths (`github.com/...`, vendored deps) to fingerprint capabilities
and third-party libraries.

### Step 4: Map and document

Map suspicious packages (networking, crypto, exec) to behavior and ATT&CK.

## Validation

- The Go build signature/version is confirmed before deeper parsing.
- Recovered names include plausible `main.*`/package-qualified functions.
- Package paths are real module paths, not random strings.

## Pitfalls

- pclntab magic differs across Go versions; try the known set.
- Obfuscators (garble) rename symbols and strip build info — names may be hashed.
- Confusing vendored library code with the author's `main` package.

## References

- See [`references/api-reference.md`](references/api-reference.md) for the analyzer.
- Go pclntab/buildinfo references (linked in frontmatter).