unclassified-go-pe64

Umbrella entity for two distinct Go PE64+ clusters that share the unclassified-go-pe64 family label. The first cluster (589af0f8, a5520aba, 82ee3cdd, cc4aa789) is a signed loader / potential infostealer build with randomized main.* function names and GoDaddy DV certificates. The second cluster (9665ccc9) uses fake source-path masquerades in the Go pclntab. Both are low-confidence, unattributed, and static-only.

Cluster A — Randomized Function Name + GoDaddy DV Cert Builds

Overview

Striped Go binaries compiled with -trimpath and randomized main.* function names. Signed with GoDaddy DV TLS certificates issued to throwaway domains (maybe.us). No .rsrc section, no hardcoded C2 strings, no browser/wallet targets recovered statically. The presence of MD5/SHA256 crypto routines seeded from time suggests runtime key generation for a second-stage payload.

Build Stack

• Go 1.25.4 (gc) ^[strings.txt]
• CGO_ENABLED=0
• GOARCH=amd64, GOOS=windows
• Linker flags: -H=windowsgui (implied by GUI subsystem)
• Authenticode: Go Daddy Secure Certificate Authority - G2 DV cert, CN=maybe.us, serial 86:ee:39:e0:b3:fd:88:5f ^[binwalk.txt]

Deploy / TTPs

No runtime behavior confirmed (no CAPE guest). Potential TTPs inferred from build artifacts:

• T1587.002 — Obtain Digital Certificates: purchased or fraudulently obtained DV cert to bypass SmartScreen / EDR reputation checks.
• T1027.002 — Obfuscated Files or Information: Go -trimpath + randomized main.* function names strip developer identity and hinder analyst navigation.
• T1059.003 — Windows Command Shell / Go execution: native PE execution, no command-line staging.

Notable Analyses

• /intel/analyses/589af0f87f4087f34750995ce679024df4e04acd0d096fe49e7f1223cb5905ae.html — First observed sibling; MD5 hash routine (main.jrcmvk)
• /intel/analyses/a5520abaff0664d2c9c62b2009f3ad663a2f24edc6307162b2124e5ee1b30abd.html — Near-identical sibling; adds SHA256 (main.bwrzkmud) and MD5 comparison (main.rrewqtyq) routines

Cluster B — Fake Source-Path Masquerade

Overview

Striped Go binaries compiled with -ldflags="-s -w" retain source-file names in the runtime program counter / line number table (pclntab). An actor can embed fake vendor paths (e.g. Microsoft.WindowsSoundDiagnostics) that survive stripping and mislead analysts into attributing the binary to a legitimate software vendor. Because the actual payload logic may live entirely in compiled Go bytecode with no static strings, network connections, or imports, the binary presents a minimal static footprint.

Build Stack

• Go 1.25.1 (gc)
• CGO_ENABLED=0
• GOARCH=amd64, GOOS=windows
• Linker flags: -H=windowsgui -s -w ^[/intel/analyses/9665ccc9c343bbb48847b09f7b771995083eba55823ad0284caa68a6a032368b.html]

Deploy / TTPs

No runtime behavior confirmed. Single sample had no CAPE detonation (no Windows guest). Potential TTPs inferred from build artifacts:

• T1036.005 — Masquerading: fake source path claiming Microsoft / Realtek origin.
• T1027.002 — Obfuscated Files or Information: symbol stripping via -s -w.
• C2 and payload assumed runtime-resolved (no static evidence).

Notable Analyses

• /intel/analyses/9665ccc9c343bbb48847b09f7b771995083eba55823ad0284caa68a6a032368b.html — First observed sample

Capabilities

• go-function-name-randomization
• go-symbol-strip-s-w
• fake-sourcepath-masquerade
• runtime-c2-resolution-hypothesized
• minimal-iat-kernel32-only
• md5-sha256-runtime-key-generation
• godaddy-dv-cert-signing

Related Entities

• golang-stealer-build-pattern — Build/RE concept page for the randomized-function-name cluster
• go-fake-sourcepath-masquerade — Technique page for the pclntab masquerade pattern
• acrstealer — Distinct Go infostealer family with similar build artefacts but confirmed C2 and credential theft
• lummastealer — Go infostealer sibling cluster with fused-string API decoding
• vidar — Go infostealer with stolen Amazon Authenticode certificate