Go Get 'Em: Updates to Volexity Golang Tooling
Summary: Volexity released a new IDA Pro and Ghidra plugin called GoStringExtractor and added runtime type information (RTTI) parsing to its existing GoResolver tool, aimed at analyzing obfuscated and unobfuscated Golang malware samples. The company noted that a significant portion of the Golang samples it encounters have been obfuscated by Garble or similar tools, and that Go's compiler organizes string data in an unterminated table ordered first by length and then alphabetically, which complicates analysis.
Why it matters: Golang is increasingly the language of choice for malware developers, and Garble-style obfuscation strips build information that standard reverse-engineering tools will not recover - so analysts facing these samples are working without the type and string data that reveal what a binary actually does.
Read the original at Volexity Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026