Malware on the Go

Presented at VB2017, Oct. 6, 2017, 2:30 p.m. (30 minutes)

Go provides a fast compilation environment to create native platform binaries without the need to understand and handle some programming paradigms associated with lower languages like C. This provides an easier entry for malware authors to create malicious binaries that will work for different operating systems. The popularity and adoption rate of the language will make it an enticing vehicle for malware development. How is Golang used in malware? Are malware authors writing malware in Go? Using it as a dropper? Trojan? RAT? This talk will cover: * A study of Go in malware * A couple of malware families/samples leveraging Go * Challenges Go executables present for analysts * How to overcome some of the challenges *(Note: this is a reserve paper for VB2017. Unless needed to replace another paper on the main programme, it will be presented in the Small Talks room at 14:30 on Friday 6 October. Programme changes will be announced at the event and displayed on the VB2017 [programme page](/conference/vb2017/programme/ "Programme").) *

Presenters:

• Angel Villegas - Cisco Systems
  Angel M. Villegas Angel M. Villegas is a malware reseacher for Cisco Talos. Amongst Angel's notable achievements, he is the author of FIRST - the Function Identification & Recovery Signature Tool, which allows infosec analysts and reverse engineers to perform collective malware analysis. Angel is also the creator of the Villegas Diet - a revolutionary new way to consume the tears of malware authors for sustenance. Angel's hobbies include hot air balloon surfing, lion fish taming, and Sumarian freestyle rapping.

Links:

• https://www.virusbulletin.com/conference/vb2017/abstracts/malware-go

Similar Presentations:

• VB2017 / Record and replay debugging against in-the-wild exploit kits and other practical cases
• VB2017 / Peering into spam botnets
• BSidesSF 2019 / A Deep Dive into Go Malware: Using Metadata to Empower the Analyst