Reverse Engineering Go Malware: A BianLian Story

Reversing Go malware is hard for reasons that standard tools were not built around. Most reverse engineering tooling assumes C or C++, and a Go binary carries a large amount of standard library and runtime code, so the real task is separating the author's logic from library code. The speaker, a malware reverse engineer, uses BianLian, a ransomware group whose toolchain is written in Go, as a case study. He begins with a small test program to show how Go's internal symbol tables look in disassemblers.

Next the talk covers the group's encryptor, a command-and-control implant that tunnels traffic through a SOCKS proxy, and a proxy forwarder. Recovering the Go symbol table restored function names and imports, which made the code readable. Build metadata such as version control revisions and build paths helped link samples together. After the group's encryption key was exposed, its later builds used string obfuscation, and the speaker used the imrit fuzzy function-matching tool to compare new samples against a corpus of roughly 300 known BianLian binaries. Matching recovered most of the functions and library identities even where strings were hidden.

The talk also traces how the group's operations shifted, from data theft and encryption to data-theft-only extortion and reliance on affiliates. The closing points for practitioners are to restore Go metadata before analysis, separate library code from author code early, and use binary diffing against a known corpus when obfuscation removes readable strings.