agentsclimarketplace

Analyzing golang malware internals

Skill meltedinhex/analyst-ai-pack/skills/analyzing-golang-malware-internals

An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-golang-malware-internals

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Analyzes Go-compiled malware by recovering function names from the pclntab, detecting the Go build/version string, and listing embedded package paths to overcome stripped symbols. Activates for requests to analyze Go malware, recover Go function names, or identify a Golang binary build.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.7 KB, as published. Nobody here has run it

Analyzing Golang Malware Internals

When to Use

  • You have a Go-compiled binary (often large, statically linked) and standard symbol recovery fails because user symbols are stripped.
  • You need function names from the pclntab, the Go version, and embedded package/module paths.

Do not use this for non-Go binaries — confirm the Go build signature first. This skill reads the binary statically and executes nothing.

Prerequisites

  • The Go binary (read inertly).

Safety & Handling

  • Read bytes statically; treat strings as untrusted data.

Workflow

Step 1: Confirm it is Go and get the version

python scripts/analyst.py info sample.bin

Looks for the Go build ID, the go1.x version string, and runtime. references.

Step 2: Recover function names from pclntab

The pclntab (preceded by a magic like \xfb\xff\xff\xff/\xf0\xff\xff\xff across Go versions) contains function name strings; extract main.*, package-qualified, and runtime.* names.

Step 3: Enumerate package paths

List embedded import/module paths (github.com/..., vendored deps) to fingerprint capabilities and third-party libraries.

Step 4: Map and document

Map suspicious packages (networking, crypto, exec) to behavior and ATT&CK.

Validation

  • The Go build signature/version is confirmed before deeper parsing.
  • Recovered names include plausible main.*/package-qualified functions.
  • Package paths are real module paths, not random strings.

Pitfalls

  • pclntab magic differs across Go versions; try the known set.
  • Obfuscators (garble) rename symbols and strip build info — names may be hashed.
  • Confusing vendored library code with the author's main package.

References

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.