Реверс-инжиниринг Go-малвари в Ghidra

★ 8.4 · security

analyzing-golang-malware-with-ghidra is a Claude Code skill that reverse-engineers Go-compiled malware inside Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped or garble-obfuscated function names via GoResolver (Volexity, 2025), and extracting embedded module paths, third-party dependency strings, and type information from the binary. Go malware poses a unique challenge: static linking produces self-contained binaries of 5–15 MB with thousands of functions, non-null-terminated strings, and goroutine concurrency patterns that confuse standard Ghidra analysis. The skill suits SOC analysts and threat hunters who need to deobfuscate a garble-packed sample, identify C2 frameworks or encryption libraries from embedded dependency metadata, or build detection rules mapped to MITRE ATT&CK techniques T1027, T1140, and T1620.

• #golang-malware
• #ghidra
• #reverse-engineering
• #malware-analysis
• #binary-analysis
• #go-binaries