Making oRAT, Go

The talk examines oRAT, a macOS malware sample written in Go and tied to the Earth Berberoka group. It starts with triage: the binary is a UPX-packed 64-bit Mach-O that expands to a much larger executable because Go statically bundles its libraries. The speaker walks through the difficulties of reversing Go binaries, including strings that are not null-terminated and confuse disassemblers, and shows how to separate third-party code from the malicious logic.

Rather than reverse engineering every feature by hand, the analysis recovers the encrypted configuration appended to the file, decrypts it with AES-GCM, and re-encrypts a copy pointing at a custom server. Because the implant multiplexes all its traffic over one connection using the smux library, the speaker built a matching Go server that opens streams and sends routed tasking requests. Process, file and network monitors then recorded the implant carrying out commands such as info collection, file download, a tunnel, a port scan and self-deletion. A separate section covers a local privilege escalation zero-day in Parallels' installer, presented as an aside.

The main takeaways are that studying APT malware reveals its capabilities and sophistication, and that dynamic analysis through a purpose-built server can be more efficient than heavy static reversing. The speaker also notes that a reconfigurable implant paired with a compatible server is useful to analysts and to attackers alike.