GoResolver: Using Control-flow Graph Similarity to Deobfuscate Golang Binaries, Automatically

In the course of its investigations, Volexity frequently encounters malware samples written in Golang. Binaries written in Golang are often challenging to analyze because of the embedded libraries and the sheer size of the resulting binaries. This issue is amplified when samples are obfuscated using tools such as Garble , an open-source Golang obfuscation tool. The popularity of Golang amongst malware developers, and the use of obfuscators to make reverse-engineering harder,…

Diamond Model