Pages from a Sword Makers Notebook pt 3 The cursed blade

The speaker, presenting remotely, recounts a Go-based wrapper they wrote years earlier for Mimikatz, the credential-dumping tool. The wrapper worked in stages: a packer fetched a Mimikatz release, split the binary into two random pads that XOR back together, and used a shellcode loader to run it from memory. A small "fixer" step marked every binary section as executable, which Go's runtime would normally reject, and that choice largely slipped past antivirus scanning.

When the speaker noticed a third party repeatedly uploading the tool to VirusTotal, they shipped an update containing a backdoor. At build time it collected host details such as usernames, environment variables, monitor screenshots and the public IP address, encrypted the data with a static key and embedded it in the binary, so nothing was sent over the network. Over roughly a year, samples returned to VirusTotal carried data from many build machines. The speaker walks through those machines and what they suggest about the operators, linking usernames and IP ranges to organizations and regions, though many of these links are offered as inference rather than confirmed fact.

The story ends when the operators found comments in the source code and worked out what had happened. The speaker then removed the backdoor and changed the cryptography to evade detection again. The practical lessons are that data can be hidden inside shipped binaries, that Go binaries can sidestep signature-based scanning, and that public sandbox uploads can reveal the environments of the people who build and run tools.