Go Function Name Randomization

Anti-static technique observed in Go-compiled malware where the main package functions are given random alphanumeric names at build time. The Go compiler preserves these names in the .gopclntab/.symtab sections, so they appear in string extraction but convey no semantic information.

Mechanism

The builder (often an automated build pipeline or a custom Go tool) renames all exported and unexported functions in the main package before compilation. Names are typically 6–20 characters of mixed-case alphanumeric text (e.g. Bordyq, edasofqhlijff).

Impact

• Hinders family clustering based on function-name signatures
• Breaks simple string-based IoC matching
• Forces analysts to rely on behavioral or decompiled-code analysis rather than symbol names

Observed In

• vidar — 155 randomized main.* names, module path dkPrXourxwYLmLN
• menomoushop — randomized main.* names, fabricated Authenticode
• acrstealer — randomized module paths and function names
• 9d2ca3 — 39 randomized main.* functions
• 54e64e — 32 randomized main.* functions

Detection

Look for PE32+ binaries with go1. version strings and a main. symbol table where every function name is 6–20 chars of random alphanumeric text with no semantic meaning. This is distinct from Go's own runtime function names (runtime.mallocgc, runtime.schedule, etc.), which remain human-readable.