The Gopher in the Room: Analysis of GoLang Malware in the Wild
Unit 42 analysis of 10,700 Go-compiled malware samples shows steady growth in the wild, with 92% targeting Windows and top families including Veil, GoBot2, and HERCULES.
Unit 42 collected roughly 10,700 unique Go-compiled malware samples and found that Go usage by malware developers has steadily risen in recent months. About 92% of samples targeted Windows and 75% were attributed to known families, led by Veil, GoBot2, and HERCULES. The most prevalent groupings were penetration testing tools, remote access Trojans, and backdoors. Statically linked Go binaries average 4.65MB, which can complicate phishing delivery but sometimes causes antivirus products to skip or fail scanning.
- 92% of Go malware samples were compiled for Windows
- 75% of samples mapped to families, led by Veil, GoBot2, HERCULES
- Go binaries average 4.65MB due to static linking, sometimes evading AV
- One Go codebase compiles for Windows, macOS, and Linux
- Collection used user-agent strings, PE sections, and YARA rules
- Vendors
- Palo Alto Networks
- Threat actors
- Chafer
- Organizations
- Unit 42
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 2a7da0a0acadb61fb79fa4a33130d09ecff5a904b0999d264d8c1edffeffea95 | ion = "the HERCULES malware family written in Go." hash1 = "2a7da0a0acadb61fb79fa4a33130d09ecff5a904b0999d264d8c1edffeffea95" hash2 = "6e68dafbb717daf6a505d8a95c41e5114d91c4fde70334335 |
| sha256 | 645ed38f2d55b2f7731d5c9223329428592497eb95c96bcd7c01a4eaeb38e137 | 6a505d8a95c41e5114d91c4fde703343356352c1ca5cd24ea" hash3 = "645ed38f2d55b2f7731d5c9223329428592497eb95c96bcd7c01a4eaeb38e137" reference = "https://github.com/EgeBalci/HERCULES" strings |
| sha256 | 6e68dafbb717daf6a505d8a95c41e5114d91c4fde703343356352c1ca5cd24ea | fb79fa4a33130d09ecff5a904b0999d264d8c1edffeffea95" hash2 = "6e68dafbb717daf6a505d8a95c41e5114d91c4fde703343356352c1ca5cd24ea" hash3 = "645ed38f2d55b2f7731d5c9223329428592497eb95c96bcd7 |
| sha256 | fc684bbf9428a4e33c390e3963c9bfa24e81cb040ccd601c6e7f5b6c193e2808 | running this is below: $ python find_interesting_strings.py fc684bbf9428a4e33c390e3963c9bfa24e81cb040ccd601c6e7f5b6c193e2808.bin 'main.encryptFile' 'main.writeLog.func1' 'main.writeLog |
From the original article
10 min read at unit42.paloaltonetworks.com
In recent months, I have taken a keen interest in malware written in the Go programming language. Go, sometimes referred to as GoLang, was created by Google in 2009 and has gained additional popularity within the malware development community in recent years.
By Josh Grunzweig · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.