54e64e: 8017acd5 — Go 1.25.4 signed PE64+ with fabricated godaddy.com/WE1 Authenticode, 32 randomized main.* functions

Executive Summary

Go 1.25.4 Windows x64 binary (~1.99 MB) carrying a fabricated Authenticode signature that claims CN=WE1 issued by godaddy.com. Thirty-two randomized main.* function names fragment the payload logic. No .rsrc section, no hardcoded C2 strings, and no dynamic detonation (CAPE skipped). Build artefacts place it firmly in the golang-stealer-build-pattern cluster alongside lummastealer, 9d2ca3, and neuralpulsecore5sbs siblings. The OpenCTI umbrella label 54e64e groups this with unrelated MSVC/UPX droppers; the Go morph is distinct.

What It Is

The certificate is fabricated: a legitimate GoDaddy code-signing cert carries an organizational DN (O, OU, L, ST, C) and is chained to the GoDaddy root. This cert has only a commonName field and a three-month validity window, consistent with throwaway self-signed templates reused across the cluster.

How It Works

The binary follows the standard Go Windows runtime entry point (0x743A0) and initializes ~32 functions in the main package with randomized 10–20 character names (e.g., main.Rapulqfqfpufdte, main.Kzosntjxoftfkfn). ^[strings.txt:5014–5052] This fragmentation hinders static analysis and family clustering by name.

CGO_ENABLED=0 is inferred from the pure-Go import table: only kernel32.dll is imported for the Windows syscall shim, with no C runtime dependencies. ^[pefile.txt]

No hardcoded C2 URLs, IP addresses, wallet regexes, Telegram tokens, or browser target strings appear in the static string set. ^[strings.txt] Cluster siblings resolve these at runtime via fused-string API decoding or runtime-generated buffers. The absence of .rsrc removes the usual icon-masquerade vector, reducing forensic footprint.

A binwalk hit for mcrypt 2.2 blowfish at 0x1B07C3 is a false positive produced by .rdata entropy in Go binaries; no encrypted payload overlay exists. ^[binwalk.txt:5]

Decompiled Behavior

Ghidra/radare2 deep decompilation was not pursued. A 2 MB Go binary with 32 randomized main.* symbols yields thousands of indistinguishable runtime functions; cluster attribution and certificate forensics are more efficient than CFG inspection for this morphology. rabin2 confirms lang: go, entry0, and the standard PE64+ layout. ^[rabin2-info.txt]

C2 Infrastructure

None recovered statically. C2 infrastructure is runtime-decoded or generated. ^[strings.txt]

Interesting Tidbits

• The godaddy.com/WE1 certificate template has been observed on at least one prior sibling (sample 389e1ccf, filename EclipseV2.exe). ^[golang-stealer-build-pattern.md]
• Go build ID can be clustered with other samples from the same compilation session.
• capa signatures are missing on this host, so no capability map was generated. ^[capa.txt]
• floss failed with an argument parsing error. ^[floss.txt]

How To Mess With It (Homelab Replication)

Toolchain: Go 1.25.4, GOOS=windows, GOARCH=amd64, CGO_ENABLED=0, -trimpath=true.

Compile a small program with randomized function names and sign it with a self-signed cert mimicking the godaddy.com/WE1 pattern. Compare strings output to the sample: you should see go1.25.4, Go build ID:, and the randomized main.* names.

Verification: rabin2 -I reproducer.exe should report lang go, signed true, stripped false.

Deployable Signatures

YARA Rule

rule win_go_stealer_godaddy_we1_54e64e
{
    meta:
        description = "Go 1.25.4 PE64+ with fabricated godaddy.com/WE1 Authenticode and randomized main.* functions"
        author = "PacketPursuit"
        date = "2026-06-11"
        sha256 = "8017acd59116f1a84c43953daa1fc856afb65f34b72f438710fcd6094ac9486b"
        family = "54e64e"
    strings:
        $go_build = "go1.25.4"
        $build_id = "Go build ID:"
        $godaddy = "godaddy.com"
        $we1 = "WE1"
        $main_rand = /main\.[A-Za-z]{12,30}/
    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)+4) == 0x00004550 and
        $go_build and
        $build_id and
        $godaddy and
        $we1 and
        #main_rand >= 15
}

Behavioral Hunt Query

Freeform (KQL/SPL): Search file-system or memory scans for PE64 binaries where strings output contains both go1.25.4 and godaddy.com, and where the Authenticode subject CN contains WE1. On Windows, Sysmon Event ID 7 (Image Loaded) or EDR file-creation events can surface the signer name WE1.

IOC List

Behavioral Fingerprint Statement

This binary is a Go 1.25.4 PE64+ compiled with CGO_ENABLED=0. It carries a fabricated Authenticode signature claiming GoDaddy CN=WE1. The main package contains ~32 randomized function names (e.g., main.Rapulqfqfpufdte). No .rsrc section is present. At runtime it likely resolves C2 addresses via decoded string buffers rather than hardcoded IPs or domains.

Detection Signatures

No capa capabilities mapped (signatures missing on host). ^[capa.txt]

References

• OpenCTI artifact: 35727111-189b-4d46-8d56-fe5297cf2bd3
• MalwareBazaar: 8017acd59116f1a84c43953daa1fc856afb65f34b72f438710fcd6094ac9486b
• Family entity: 54e64e
• Build pattern: golang-stealer-build-pattern

Provenance

Sources used for this report:

• file.txt, pefile.txt, rabin2-info.txt, strings.txt, binwalk.txt, metadata.json, exiftool.json, capa.txt, floss.txt, ssdeep.txt, tlsh.txt
• OpenSSL ASN.1 parse of the embedded WIN_CERTIFICATE (on-host analysis).
• Cluster correlation via golang-stealer-build-pattern.md and entities/54e64e.md.