DEF CON 33 - Go Malware Meets IoT - Challenges, Blind Spots, and Botnets - Asher Davila

The presentation discusses the growing trend of Golang-based malware, analyzing why malware authors are increasingly using Go and examining the challenges in analyzing such malware 0:52. Key characteristics of Go that make it attractive to malware writers include cross-platform support, self-contained statically linked binaries, and increased difficulty for static analysis compared to C/C++ 1:33.

The speakers present several examples of Go-based malware families including GoBruteforcer, SeacryGo, CodeTier, and Pumabot, demonstrating how this malware targets various platforms and systems 3:24. They highlight the analysis challenges posed by Go malware, such as large file sizes, high function counts, tooling limitations, and unique string handling mechanisms 5:29.

The presentation showcases various tools and techniques for analyzing Go binaries, including Ghidra with Go-specific plugins, radare2, and AI-assisted analysis tools like R2AI and Ghidra MCP 7:08. They demonstrate practical analysis of IoT malware samples like BotanaGo and Pumabot, showing how to extract configuration data, identify command and control infrastructure, and reconstruct attack payloads 23:14.

Sources:

• 0:52 Introduction to Golang and malware trends
• 1:33 Why malware writers use Go language
• 3:24 Examples of Go-based malware families
• 5:29 Analysis challenges with Go binaries
• 7:08 Tooling options for Go analysis