> Concept · golang-stealer-build-pattern_

~/packetpursuit $ cat /intel/concepts/golang-stealer-build-pattern.md

typeconceptconfidencehighcreated2026-08-19updated2026-08-19golanginfostealerbuild-pattern

golang-stealer-build-pattern

Recurring build artefacts observed across Go-based infostealer families (ACR Stealer, Lumma, XenoRAT).

Markers

  • GOOS=windows, GOARCH=386 or amd64
  • CGO_ENABLED=0
  • -trimpath=true
  • Randomized module path in build info
  • 20–90 randomized main.* function names
  • Null PE timestamp
  • Optional: self-signed or valid DV TLS certificate
  • Optional: .rsrc icon suite (0–8 PNG icons)

See Also