Making oRAT Go...Further
summary
Reconfigures a UPX packed 10 MB Go binary by extracting and reappending an AES GCM encrypted overlay to point at a lab C2, builds a custom Go C2 using smux to handle the malware’s multiplexed session, and sends multiplexed HTTP-like route requests to trigger actions. Uses UPX, strings, otool, netcat, debugger, file/process/network monitors and Go. Confirms routes: /agent/info returns host survey, /agent/download exfiltrates files, /agent/get creates a tunnel, port scan and selfdelete work, screenshot is not implemented.
AI-written summary · about
chapters (11)
- 0:00Introduction and welcome
- 2:29Background on oRAT malware
- 9:12Initial malware triage
- 12:44Reverse engineering Go binaries
- 17:37Virtualizing macOS on Apple Silicon
- 22:55Reconfiguring oRAT’s command and control
- 28:11Understanding oRAT’s protocol
- 32:42Building a custom C2 server
- 37:17Tasking malware to reveal capabilities
- 45:25Key takeaways and wrap-up
- 48:56Q&A session
related talks
47mReverse Engineering Go Malware: From Manual to AI-Powered Analysis
57mHacking with Go
49mxRAT
40mOver the Air, Under the Radar: Attacking and Securing the Pixel Modem
27mA Deep Dive into Go Malware: Using Metadata to Empower the Analyst
33mOperation GamblingPuppet: Analysis of a Multivector and Multiplatform Campaign Targeting Online ...
33mHacking in Darkness: Return-oriented Programming against Secure Enclaves
46mNakatomi Space: Lateral Movement as L1 Post-exploitation in OT