Reversing in action: Golang malware used in the SolarWinds attack. Part 1

Ivan Kwiatkowski explains the fundamentals of analyzing Go binaries and begins reversing the Sunshuttle malware used in the SolarWinds attack.

Earlier this year, Kaspersky introduced an online course on Targeted Malware Reverse Engineering from GReAT’s Senior Security Researchers. The training covered 10 real-life APT cases in several programming and scripting languages (C, .NET, Delphi, Powershell, JavaScript, C++), but questions about the Golang language kept coming up. Indeed, Go language has become increasingly popular and widespread, even among malware authors. ​This video is the first part of a newly launched bonus track on the course, where Ivan Kwiatkowski explains how to analyze malware written in Go language on a Sunshuttle sample used in the SolarWinds attack. In part one, Ivan covers fundamentals of the Go language​, explaining how simple Go programs work and how to analyze them. Then he switches to the reversing part, focusing on Sunshuttle’s way of obtaining configuration information. Read a blogpost about the Tomiris backdoor and its connection to Sunshuttle kas.pr/6wbn Learn more with Ivan Kwiatkowski and other GReAT experts at kas.pr/5v4d 00:00 – Introduction 02:24 – Golang Malware: Theory 14:07 – Reverse engineering Sunshuttle: Step 1 #KasperskyExpertTraining #TargetedMalware #MalwareAnalysis #ReverseEngineering #APT #KasperskyGReAT #ReversingWorkshop #GolangMalware #GoMalware #SolarWinds #Sunburst #Sunshuttle #Tomiris