https://cryptax.github.io/tags/go/Go - Tag - The handbag of CryptaxHugo -- gohugo.ioen-uscrypto.maniak@gmail.com (Cryptax)crypto.maniak@gmail.com (Cryptax)Fri, 06 Nov 2026 00:00:00 +0000https://cryptax.github.io/posts/gogra_dropper/Fri, 06 Nov 2026 00:00:00 +0000cryptaxhttps://cryptax.github.io/posts/gogra_dropper/GoGra Linux Dropper analysis GoGra is an backdoor family which emerged in 2024, mostly targeting India and Afghanistan. In April 2026, its developers released a Linux variant, which was analyzed here. In this blog post, we’ll go over a few interesting functionalities which were not detailed in that prior analysis. IOC: 9c23c65a8a392a3fd885496a5ff2004252f1ad4388814b20e5459695280b0b82 Background info GoGra was first seen in November 2023. It is written in Go and abuses the Microsoft Graph API.https://cryptax.github.io/posts/gogra_payload/Fri, 06 Nov 2026 00:00:00 +0000cryptaxhttps://cryptax.github.io/posts/gogra_payload/GoGra Linux Payload analysis This blog post continues our analysis of GoGra Linux variant. In a first part, we analyzed the Dropper and found out it was displaying a decoy PDF and executing another binary. In this second part, we analyze the other binary, also called payload or implant. Pclntab The implant is stripped, so at first, Ghidra sees no function names, filenames etc. Note that, at first, our LLM did not know at all how to deal with Go binaries.