https://cryptax.github.io/tags/strings/strings - Tag - The handbag of CryptaxHugo -- gohugo.ioen-uscrypto.maniak@gmail.com (Cryptax)crypto.maniak@gmail.com (Cryptax)Fri, 06 Nov 2026 00:00:00 +0000https://cryptax.github.io/posts/gogra_payload/Fri, 06 Nov 2026 00:00:00 +0000cryptaxhttps://cryptax.github.io/posts/gogra_payload/GoGra Linux Payload analysis This blog post continues our analysis of GoGra Linux variant. In a first part, we analyzed the Dropper and found out it was displaying a decoy PDF and executing another binary. In this second part, we analyze the other binary, also called payload or implant. Pclntab The implant is stripped, so at first, Ghidra sees no function names, filenames etc. Note that, at first, our LLM did not know at all how to deal with Go binaries.