> Concept · Go Infostealer Build Pattern_

~/packetpursuit $ cat /intel/concepts/golang-stealer-build-pattern.md

typeconceptconfidencehighcreated2026-05-27updated2026-06-05compilergolangobfuscationinfostealer

Go Infostealer Build Pattern

Recurring build artefacts observed in Go-based infostealers compiled for Windows. First documented in the PacketPursuit corpus for the acrstealer family, but the settings are generic and may appear in other Go stealers.

Pattern Definition

Setting Value Purpose
go version go1.26.2 (or near-current) Latest stable at time of build
GOOS windows Target platform
GOARCH 386 32-bit build (smaller footprint, broader compatibility)
CGO_ENABLED 0 Static binary, no C dependencies
-trimpath=true Set Removes absolute source paths from binary
Module path Random 12–20 alphanumeric chars Anti-attribution; poisons dependency graphs
Function names Randomized main.* identifiers Hinders static analysis and family clustering
Signing Authenticode certificate (often self-signed or low-reputation CA) Social-engineering trust
Resources .rsrc with 256×256 PNG icons Masquerades as legitimate application

Detection

Look for the combination of go1.26.2 + CGO_ENABLED=0 + -trimpath=true + a module path that is purely random alphanumeric, inside a signed PE32. The .text entropy stays below 6.5 because no external packer is used — the obfuscation is compile-time only.

Observed In

  • acrstealer — siblings with module paths vcCgXjVCTGAvGkl, PfeYrYvazVUGgZq, hlHtIOAoWQhvCrI, JPYhJIzovpOdAaG, rDRsLkGEEednpRk, gesiimdPYMojqEh, yCJjClxMaPcdOeL, and JyUjBKWCTzoLKTp (eighth sibling, 2026-07-09). All share Go 1.26.2, CGO_ENABLED=0, -trimpath=true, randomized main.* functions, and the me.muz.li / R13 certificate chain. Newer siblings omit static C2 in favour of PRNG-seeded runtime decoding.
  • lummastealer — Go 1.25.4, module path NZlhQRhWFITWnSR; notable absence of .rsrc icon section, distinguishing it from ACR Stealer siblings
  • menomoushop — Go 1.25.4, randomized main.* function names, Authenticode signed (Go Daddy DV CN maybe.us), .symtab retained^[/intel/analyses/3aca18df0426522e0c301a55dae3d892b2009719854207b4bae45f4c94403c9f.html]
  • 9d2ca3 — Go 1.25.4 PE64, module path wqeHivEQWBGOQgj, 39 randomized main.* functions, fabricated Authenticode (CN=askart.com), fused-string API decoding, no .rsrc section. Also demonstrates GOARCH=amd64 builds in this cluster.
  • Sample 389e1ccf — Go 1.25.4 PE64, module path LUOegnbUmXZeMZT, 43 randomized main.* functions, fabricated Authenticode with godaddy.com/WE1 strings, same fused-string API decoding pattern, filename EclipseV2.exe. Third confirmed sibling in the 9d2ca3 Go cluster.
  • Sample 8017acd5 — Go 1.25.4 PE64+, build ID M5d1UAj2sgoz..., 32 randomized main.* functions, fabricated Authenticode CN=WE1 / issuer=godaddy.com, no .rsrc, no hardcoded C2. Same certificate template as 389e1ccf. Fourth confirmed sibling. ^[/intel/analyses/8017acd59116f1a84c43953daa1fc856afb65f34b72f438710fcd6094ac9486b.html]
  • vidar — Go 1.25.10 PE64+, module path dkPrXourxwYLmLN, 155 randomized main.* functions, stolen Amazon-issued Authenticode (CN=*.merriam-webster.com), no .rsrc section. Static-only; no hardcoded C2 strings.^[/intel/analyses/3799d1f74d955e7f65e65ff1a35e07b94eb978992a0bea545aeb8c7a09f1c922.html]
  • unclassified-go-pe64 — Go 1.25.4 PE64+ cluster (589af0f8, a5520aba, cc4aa789, 82ee3cdd) with randomized main.* function names, GoDaddy DV cert CN=maybe.us, no .rsrc, no hardcoded C2. MD5/SHA256 crypto routines seeded from time suggest runtime key generation for second-stage payload.^[/intel/analyses/a5520abaff0664d2c9c62b2009f3ad663a2f24edc6307162b2124e5ee1b30abd.html]