> Family · goloader — Go Reflective Runtime Linker Malware_

~/packetpursuit $ cat /intel/families/goloader.md

typeentityconfidencehighcreated2026-06-08updated2026-06-08loadergolangreflective-loadingdefense-evasionmalware-family

goloader

Malware family that weaponizes the legitimate open-source project github.com/pkujhd/goloader — a Go dynamic linker that loads compiled Go object files (*.o, *.a) into a running process at runtime. The technique enables reflective loading of a second-stage Go payload without ever writing it to disk.

Overview

Attribute Value
First observed 2026-06-08 (sample 4e286cd9)
Platform Windows PE64 AMD64
Compiler Go 1.25.1 (latest stable at time of build)
Build flags CGO_ENABLED=0, -trimpath=true
Signing None observed (unsigned, manifest-only masquerade)
Module path goloader (generic, no randomized module path)

Build / RE

  • Outer shell — Standard Go PE64 with randomized main.* function names (18+ functions)^[sample 4e286cd9/strings.txt:4879-4900]. The legitimate goloader source files are preserved in the symbol table: goloader/loader.go, goloader/vm.go, goloader/exe_main.go, goloader/consts_gen.go, goloader/markers_gen.go^[sample 4e286cd9/strings.txt:5301-5305].
  • Payload packaging — Second-stage Go object is encrypted with AES-CBC (FIPS 140-3 mode) and zlib-compressed, then embedded as a high-entropy PE resource (id 16)^^[sample 4e286cd9/pefile.txt:454-455]. AES S-Box lives in .rdata^[sample 4e286cd9/binwalk.txt:8-9].
  • Decryption primitives — crypto/internal/fips140/aes.NewCBCDecrypter, SHA-256, SHA-3 (SHAKE), HMAC-SHA2-256^[sample 4e286cd9/strings.txt:4864-4984].
  • Anti-analysis — Minimal. No debugger/VM checks in static strings. Go 1.25.1 may outdate sandbox heuristics. No Authenticode signature, only fabricated RT_MANIFEST (vertexexpertleaf.service_decoder)^^[sample 4e286cd9/pefile.txt].
  • No standard Go stealer pattern — Unlike acrstealer, lummastealer, orderreshop, or menomoushop, this sample lacks .rsrc icon resources and randomized alphanumeric module paths. It diverges from the documented golang-stealer-build-pattern.

Deploy / ATT&CK

ID Technique Evidence
T1203 Exploitation for Client Execution (Execution) goloader runtime linking of arbitrary Go code^[sample 4e286cd9/strings.txt:5301-5305]
T1620 Reflective Code Loading Encrypted payload decrypted in memory, linked without file write^[sample 4e286cd9/pefile.txt:454-455]
T1027 Obfuscated Files or Information AES-CBC + zlib compression of embedded payload^[sample 4e286cd9/strings.txt:4864-4878]
T1083 File and Directory Discovery GetTempPathW, FindFirstFileW imports^[sample 4e286cd9/strings.txt:1971-1990]

Capabilities

  • go-reflective-loader-goloader-linking
  • aes-cbc-encrypted-pe-resource-payload
  • zlib-decompress-payload-staging
  • in-memory-go-module-execution
  • manifest-masquerade-random-words
  • virtualalloc-createthread-process-primitives
  • static-only-c2-obfuscation (actual C2 presumed inside encrypted second stage)

Variants / Aliases

  • Triage pipeline co-label: legionloader (unverified, no corroborating evidence).

Related

  • golang-stealer-build-pattern — Divergent build pattern; shares Go compiler but not module-path randomization or signing.
  • acrstealer — Go infostealer cluster with randomized module paths and TLS C2.
  • lummastealer — Go infostealer cluster with PRNG C2 resolution.
  • orderreshop — Go infostealer with custom PE parser.

Notable Analyses

  • /intel/analyses/4e286cd901813a5f80411e417fb5defe25ff9af00706e68509392f6e75cc3908.html — Single-sample static deep-dive. No CAPE detonation.