Malware on the Go

Friday 6 October 14:30 - 15:00, Small talks

Angel Villegas (Cisco Systems)



Go provides a fast compilation environment to create native platform binaries without the need to understand and handle some programming paradigms associated with lower languages like C. This provides an easier entry for malware authors to create malicious binaries that will work for different operating systems. The popularity and adoption rate of the language will make it an enticing vehicle for malware development.

How is Golang used in malware? Are malware authors writing malware in Go? Using it as a dropper? Trojan? RAT?

This talk will cover:

  • A study of Go in malware
  • A couple of malware families/samples leveraging Go
  • Challenges Go executables present for analysts
  • How to overcome some of the challenges

 (Note: this is a reserve paper for VB2017. Unless needed to replace another paper on the main programme, it will be presented in the Small Talks room at 14:30 on Friday 6 October. Programme changes will be announced at the event and displayed on the VB2017 programme page.) 

 

Angel-Villegas.jpg

Angel M. Villegas

Angel M. Villegas is a malware reseacher for Cisco Talos. Amongst Angel's notable achievements, he is the author of FIRST - the Function Identification & Recovery Signature Tool, which allows infosec analysts and reverse engineers to perform collective malware analysis. Angel is also the creator of the Villegas Diet - a revolutionary new way to consume the tears of malware authors for sustenance.

Angel's hobbies include hot air balloon surfing, lion fish taming, and Sumarian freestyle rapping.



VB2018 MONTREAL!

VB2017 OVERVIEW

VB2017 SPEAKERS

VB2017 PROGRAMME

VB2017 PHOTOS

2017 PÉTER SZŐR AWARD


Other VB2017 papers

Mariachis and jackpotting: ATM malware from Latin America

Thiago Marques (Kaspersky Lab)

Fabio Assolini (Kaspersky Lab)

Of all the forms of attack against financial institutions in the world, the ones that are most likely to combine traditional…

Keynote address: Inside Cloudbleed

John Graham-Cumming (Cloudflare)

In February 2017, Cloudflare was revealed to have been leaking private information including HTTP headers, cookies and POST data…

XAgent: APT28 cyber espionage on macOS

Tiberius Axinte (Bitdefender)

This paper provides an in-depth analysis of the macOS version of the APT28 component known as XAgent. We will dissect the…