go-fake-sourcepath-masquerade

What It Does

Go binaries compiled with the standard toolchain embed a program-counter-to-line-number table (pclntab) used for stack traces and panics. This table retains the original source-file paths, including any directory structure under GOPATH or GOROOT. Malware authors exploit this by placing their source inside a directory tree that mimics a legitimate vendor or product name (e.g. Microsoft.WindowsSoundDiagnostics/Cache/Go/src/...). Even after stripping DWARF (-ldflags="-s -w"), the pclntab survives and the fake paths remain visible in plain strings output, misleading analysts and detonation sandboxes into attributing the binary to a trusted vendor.

Detection / Fingerprint

• strings <binary> | grep -iE 'microsoft|google|adobe|realtek|nvidia|intel' — Look for vendor names inside Go source paths.
• Source paths that contain Go/src/ but do not match the actual module import path (check go.mod if available).
• Paths under fake Windows AppData / Local / Packages directories that do not exist on a real Windows system.
• Combined with -s -w strip flags (no DWARF, no external symtab) — the paths are the only remaining attribution clues.

Implementation Patterns Observed

In sample 9665ccc9, the actor built the binary with the following fake path:

C:/Users/K/AppData/Local/Packages/Microsoft.WindowsSoundDiagnostics/Cache/Go/src/internal/abi/escape.go
C:/Users/K/AppData/Local/Packages/Microsoft.WindowsSoundDiagnostics/Cache/Go/src/internal/cpu/cpu.go
...
C:/Users/K/AppData/Local/Packages/Microsoft.WindowsSoundDiagnostics/Cache/Go/src/runtime/netpoll_windows.go

The masquerade includes 238 instances of this fake GOPATH. The actual "entry" source file is EnableRealtekHDMIAudio.go, mimicking a Realtek driver utility. ^[/intel/analyses/9665ccc9c343bbb48847b09f7b771995083eba55823ad0284caa68a6a032368b.html]

Reproduce on Your Own VMs

1. Create the fake GOPATH tree

mkdir -p ~/fake_vendor/Microsoft.WindowsSoundDiagnostics/Cache/Go/src/
cd ~/fake_vendor/Microsoft.WindowsSoundDiagnostics/Cache/Go/src/
go mod init microsoft.com/sounddiag
cat > main.go <<'EOF'
package main
import "fmt"
func main() { fmt.Println("harmless") }
EOF

2. Build with standard Go toolchain

export CGO_ENABLED=0
export GOOS=windows
export GOARCH=amd64
go build -ldflags="-H=windowsgui -s -w" -o fake.exe .

3. Verify the masquerade survived

strings fake.exe | grep -i "Microsoft.WindowsSoundDiagnostics"
# Output: C:\Users\...\Microsoft.WindowsSoundDiagnostics\Cache\Go\src\main.go

4. Check without fake paths (control)

go build -trimpath -ldflags="-H=windowsgui -s -w" -o fake_trim.exe .
strings fake_trim.exe | grep -i "Microsoft.WindowsSoundDiagnostics"
# No output — trimpath removes source paths

Defensive Countermeasures

• Strings baseline: Compare source paths against known-good Go module paths.
• GOPATH verification: Check if the claimed vendor directory exists in the legitimate software catalog.
• Correlation: Cross-reference with Authenticode signatures — unsigned binaries claiming Microsoft/Realtek origin are suspicious.
• YARA: Detect the pattern Microsoft.WindowsSoundDiagnostics/Cache/Go/src/ or similar vendor-name Go paths in PE64+ files.

Pages Where Observed

• unclassified-go-pe64 — Entity page for the family
• /intel/analyses/9665ccc9c343bbb48847b09f7b771995083eba55823ad0284caa68a6a032368b.html — Sample analysis