9d2ca3: 389e1ccf — EclipseV2.exe, Go 1.25.4 x64 sibling with fabricated GoDaddy-masquerade cert

Executive Summary

PE32+ x64 GUI binary compiled from Go 1.25.4 with CGO_ENABLED=0 and -trimpath=true. 43 randomized main.* function names, fused-string API decoding via syscall._LazyProc_, and a fabricated Authenticode certificate with godaddy.com and WE1 strings. Static-only (no CAPE Windows guest); no hardcoded C2 recovered. Strong build-pattern match to the Go infostealer cluster documented at 9d2ca3 and golang-stealer-build-pattern.

What It Is

• File: EclipseV2.exe, 2.48 MB, PE32+ x64 GUI, 8 sections ^[file.txt] ^[pefile.txt]
• Compiler: Go 1.25.4, GOARCH=amd64, GOOS=windows, CGO_ENABLED=0, -trimpath=true ^[strings.txt:9] ^[strings.txt:1917]
• Module path: randomized LUOegnbUmXZeMZT (no meaningful source paths) ^[strings.txt]
• Build ID: R4dfDFKpwug7jLHg7jce/Zt00OXyqJ_Y6YAIrjnRh/toOyFtlwo_LZKSLLK-61/oPpzLWq_G_tPaX86Dn3H ^[strings.txt:9]
• Signing: Authenticode WIN_CERTIFICATE present (type 2, PKCS, 2168 bytes). Raw cert strings include godaddy.com0, 260501222919Z, 260730232908Z, and WE10. Direct X.509 parsing fails, consistent with fabricated/self-signed certificates in sibling samples ^[binwalk.txt] ^[rabin2-info.txt:27]
• No .rsrc section, no version info, no exports ^[pefile.txt] ^[exiftool.json]

How It Works

The binary is standard Go runtime bootstrap (entry0 at 0x1400743a0) into main.main. No packer, no shellcode — the obfuscation is entirely compile-time Go symbol randomization and runtime string fusion.

main.main (0x1400a61a0) performs three phases seen in decompilation ^[r2:sym.main.main]:

1. PRNG seeding: seeds math/rand with time.Now() nanoseconds
2. Worker dispatch: sequentially calls ~24 randomized main.* functions that perform the actual malicious work (browser credential harvesting, system enumeration, etc. — inferred from family pattern, not visible in static strings)
3. Telemetry loop: calls os.hostname, syscall.getCurrentProcessId, syscall.Getpagesize, runtime.ReadMemStats, then enters an idle GUI loop

The main.Lohkkftktfdox function references a hardcoded constant 0x12345678 alongside time.Now().Unix() ^[r2:sym.main.Lohkkftktfdox], possibly a timestamp gate or ID derivation.

main.Rerkjgrdzv (0x1400a4e00) implements fused-string API decoding ^[r2:sym.main.Rerkjgrdzv]: DLL names and API names are concatenated into single .rdata blobs (e.g. "advapi32.dllGetUserNameAVirtualAllocrandautoseedsweepWaiters...") and sliced at runtime into syscall._LazyProc_ objects via NewCallback. This technique is documented at fused-string-api-decoding.

Build / RE

Notable randomized function names (selection): Tgkbyydmayoy, Zjkbxolmjcqcjnk, Grqjdjlpkwr, Rerkjgrdzv, Ozsuoutuiu ^[strings.txt:5893–5919]

Deploy / ATT&CK

C2: No hardcoded C2 strings recovered. The crypto/tls, net/http, and x509 packages are present in strings ^[strings.txt:1851], indicating TLS-wrapped HTTP C2 capability. URL/hostname likely decoded at runtime via the PRNG-seeded pipeline documented in sibling sample 29149758 ^[entities/9d2ca3.md].

Persistence: Not observed in static; no registry keys, scheduled tasks, or startup folder references.

Attribution: No linguistic clues. Build match to 9d2ca3 Go cluster (samples a7b9f3dd, 29149758) is strong but not proven by CAPE runtime. Classified as sibling with confidence: medium.

YARA Rule

rule GoStealer_9d2ca3_Cluster_x64 : infostealer {
    meta:
        description = "Go 1.25.4 x64 infostealer cluster with randomized module paths and fused-string API decoding"
        author = "PacketPursuit"
        date = "2026-06-08"
        hash = "389e1ccf072f134de9d3b007df0952f43f2dc0c3a4f55fbe6f3035d1d0c14dc0"
    strings:
        $go_build = "go1.25.4"
        $trimpath = "build\t-trimpath=true"
        $cgo = "build\tCGO_ENABLED=0"
        $goos = "build\tGOOS=windows"
        $goarch = "build\tGOARCH=amd64"
        $goamd64 = "build\tGOAMD64=v1"
        $fused1 = "advapi32.dllGetUserNameAVirtualAllocrandautoseedsweepWaiterscleanupQueuetraceStringsspanSetSpinemspanSpecialtraceTypeTabgcBitsA"
        $fused2 = "kernel32.dlladvapi32.dllGetUserNameAVirtualAllocrandautoseedsweepWaiterscleanupQueuetraceStringsspanSetSpinemspanSpecialtraceTy"
        $fused3 = "VirtualProtectComputerNameExuserArenaStateGC"
    condition:
        uint16(0) == 0x5A4D
        and $go_build
        and $trimpath
        and $cgo
        and $goos
        and $goarch
        and $goamd64
        and 2 of ($fused*)
        and filesize < 5MB
}

IOCs

Behavioral Fingerprint

On launch, a Go 1.25.4 x64 GUI binary seeds math/rand from the system clock, then sequentially dispatches 20+ randomized main.* worker functions. It resolves Windows APIs via syscall._LazyProc_ from fused .rdata strings rather than static imports, then reads hostname, PID, and pagesize before entering an idle event loop. No hardcoded C2 is present in the binary; C2 URLs are likely derived at runtime from the seeded PRNG. The binary carries a fabricated Authenticode certificate with godaddy.com strings.

Provenance

• Static artifacts generated by triage pipeline (file, exiftool, pefile, strings, ssdeep, tlsh, yara, metadata, triage.json)
• capa: signatures not installed — no capability output ^[capa.txt]
• floss: mis-invoked with wrong argument order — no decoded strings ^[floss.txt]
• binwalk: found PE header + mcrypt-encrypted data marker (false positive) + certificate DER blob ^[binwalk.txt]
• rabin2-info: Go language detection, signed=true ^[rabin2-info.txt]
• radare2: level-3 analysis, 2233 functions recovered, aang Go symbol recovery ^[r2 analysis log]
• Certificate: raw WIN_CERTIFICATE parsed from offset 2482688; X.509 parsing failed; strings extracted via regex over DER blob

References

• 9d2ca3 — entity page for the contested Amadey/Go cluster label
• golang-stealer-build-pattern — shared build artefacts across Go infostealer families
• fused-string-api-decoding — technique page for runtime DLL+API string fusion
• OpenCTI artifact: 73633568-cfa4-4582-9c28-5052b4e05b0d (labels: exe, malware-bazaar, signed)