GoLoader In the Wild: Abusing Syscall.Syscall() to Execute Vidar, Stealc, and Remus Stealer

For the past few months, the SonicWall Threat Research team has been observing an ongoing campaign distributing various malware families, such as Vidar, Stealc, and Remus Stealer, which use loaders written in the Go Language. This loader’s main task is to decrypt, load, and execute the payload. The loader is abusing Syscall.Syscall() which is a low-level function in the Go language to execute the payload’s entry point to bypass the EDR hooks and API monitoring tools.

Infection Cycle

Malware families such as Vidar remain popular by spreading through common methods like fake CAPTCHA scripts (such as ClickFix), SEO poisoning, cracked popular software downloads, unsafe GitHub links, and emails that deliver harmful ISO files. 

GoLoader is a 64-bit Golang compiled (v1.25) binary. The attacker uses the digital certificate to mimic the legitimacy of the binary. 

Why Go?

Malware authors choose the Go language because it generates self-contained binaries that are statically compiled with all required dependencies and packages. As a result, binaries produced by the Go compiler are often large and contain library code that complicates reverse engineering.

Payload Decryption

The loader directly starts decrypting the encrypted payload present in the .rdata section. It is heavily obfuscated and involves dummy for-while loops and fake strings loading function calls to hinder analysis. 

Decryption is performed in a sequence of loops. 

After decryption is done. The decrypted payload is injected into allocated memory, and it is executed via Syscall.Syscall(). 

Understanding Syscall() 

Syscall.Syscall() is a low-level function in Go’s standard syscall package that directly executes an operating system’s system call. It takes a fn(the system call number) and up to three or more integer arguments ( depending on its variant, like Syscall6()), passing them straight to the kernel and returning results. 

In the above definition, variable c is being initialized to the winsyscall structure, which is of type libcall structure. In the GoLoader case, fn is the injected payload entry point to be executed. 

As shown in above figure, Syscall.Syscall() function is a wrapper for the Syscall.Syscalln(). Then Syscall.Syscalln() calls cgocall() with parameters asmstdcallAddr and struct c. Remember that struct c.FN has the payload entrypoint. Cgocall() calls asmcgocall_0() and so on. As per the x64 architecture, the Go runtime uses Application Binary Interfaces(ABI’s) where parameters are passed sequentially in registers RAX and RBX. Register RAX has the entrypoint address as the first argument.

Finally, the payload gets executed successfully after call rax instructions are executed. Payload observed in the analyzed loader belongs to the Vidar Family. 

Sonicwall Protection

This threat is also detected by SonicWall Capture ATP with RTDMI™,  SonicWall Endpoint Security.

IOCs

a0679070b144bb0ee29c96b977c787a83bdd2dc8ffd676440ef887a3f1e4958e - Vidar

c7bd4d80516ea71241d4d554f8441bcf523a6d91a59e9e8ddf8b35918b852dc6 – Stealc

6d9bd1e24e5f6bbdb0ae30a6a8de25043b658865f2ad2a84da382966689cdbee – Remus Stealer