Go and malware

So one of my friends was encouraging me to learn Go and while researching it I found out about a lot of spyware, malware, viruses, randsomware, gets written in Go a lot. It was pretty common. But why? Go is made by a bunch of google employees, for what reason is it that Go is used by nefarious dudes to write harmful software? I'd expect something more general like C or at least not something tangentially related to guys to work for a company that works with glowies. https://www.akamai.com/blog/security/new-p2p-botnet-panchan

Probably because it's malware programmed with a relatively new language (with an arguably easy learning curve, hence its wide adoption), most anti-malware tools probably didn't take time to adapt yet. Seems like it's still hard to analyse Go binaries today. Also, Since you can compile your code so it works on a wide variety of platforms, Go becomes pretty interesting if you want to target not just windows. This is the common talking point i see on articles just from skimming em.

It's a compiled language that's easy to write and maintain, it has decent libraries for networking, cryptography, and cross-platform development, and it has a focus on concurrency. >Go is made by Google Why would that matter at all to a malware developer?

>>20367 Runtime bloat will choke most static analysis. Most. ez language to learn and write nice features cross compilation is ez The language doesn't necessarily matter when all of your important methods end up in nt or getting slurped up by etw. That being said, I know I'm contradicting myself here, there *is* value in using esoteric languages/methods. Being created by Google is pretty much irrelevant, just as Rust being created by Mozilla is irrelevant. I personally don't like Golang for implant dev and prefer C/Rust, but I see the value in it. I don't mind using Golang tooling either, some of it is really nice out of the box like Sliver C2 for example. Stupid easy to set up and get going, if you don't mind 15MB payloads lol.

I'd use nim for malware dev now, Go's binaries while statically linked and universal are in the 100MB range which does set off a lot of flags now. Nim is a lot simpler python like syntax all the benefits of go and much smaller binaries.

>>20736 Interesting. Can you tell me more about Nim? From what I have read, the main advantages of Go are the really convenient way to do concurrency (clearly inspired by Hoare's CSP) and that it's easier than C or C++ but it also has acceptable performance.

Im so sorry bros. But any good resource for learning go?

>>20743 i haven't read it but i assume The Go Programming Language is pretty good since Kernighan is a coauthor.

>>20370 >Why would that matter at all to a malware developer? Well same reasons, anyone might would want to avoid google stuff. Spyware. Hell a few years ago google tried to plus some kind of microphone activator into chromium.

Them using a newer language means less programmers know how to use it so it likely takes more time to reverse engineer to find what vulnerabilities it exploits but yes seems odd Go is the go to. Flood detected. fuarrrk this filter

>>21006 Is there actually any telemetry in the golang toolchain?

>>20743 Work through these: https://go.dev/tour/ https://www.gopl.io https://www.youtube.com/watch?v=jFfo23yIWac (Learn Go Programming by Building 11 Projects – Full Course) https://quii.gitbook.io/learn-go-with-tests/ https://gobyexample.com/ Bonuses: https://go.dev/doc/effective_go https://www.youtube.com/@rscgolang/videos (some interesting videos) >>21019 at the moment, go get connects to Google's servers and there are plans to add (more) telemetry to Go: >>>/λ/34280