GoFlateLoader Uses Oversized PE Overlays to Deliver Infostealers
Summary
Gen Threat Labs describes GoFlateLoader, a Go loader that manually maps payloads in memory and uses 700–950 MB PE overlays to hinder scanning. It is distributed via cracked software and a malicious TDS to deliver several infostealers.
Key points
- The loader decodes payloads and manually maps them into memory, then transfers execution without writing the payload to disk.
- Its appended PE overlay inflates samples to roughly 700–950 MB; the article says this may frustrate size-limited scanning and analysis systems.
- GoFlateLoader has x86 and x86-64 variants matched to the payload architecture and reportedly lacks common anti-debugging, anti-VM, and sandbox-evasion checks.
- Observed delivery paths include cracked software and a malicious traffic distribution system (TDS) serving password-protected archives.
- Gen Threat Labs reports observing delivery of Amatera, Remus, Lumma, Vidar, StealC, and SvitStealer infostealers.
- Gen says it protected more than 33,000 unique users from GoFlateLoader since April, with notable impact in Brazil, India, Argentina, Mexico, Turkey, and Spain.
Article Details
- Attack Vectors
- Distribution through supposedly cracked software.
- A malicious TDS redirects users to landing pages offering downloadable, password-protected archives; the archive password is displayed separately.
- GoFlateLoader decodes and manually maps its payload into memory, then transfers execution without writing the payload to disk.
- A large PE overlay, typically bringing samples to 700–950 MB, is used to hinder size-limited scanning and automated analysis.
- Defensive Notes
- The article identifies unusually large PE files and appended overlays as characteristics of GoFlateLoader samples.
- Password-protected archives may conceal the loader until a victim manually extracts them; the password may be displayed separately from the download.
- The loader uses in-memory payload execution and import rebuilding, and the article reports that it lacks anti-debugging, anti-VM, and sandbox-evasion checks.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 121c2dc793b3873f75a29ec02241f94136de19c049382a50a50d0d5b99507073 | Hash of a GoFlateLoader x64 sample loading StealC. |
| SHA256 | 2415db5081cec9bfd14ad6da1a66169fd96f13a49010c319a73d1ed6fafd4efa | Hash of a GoFlateLoader x64 sample loading Vidar. |
| SHA256 | 421ce2d2f49c23bbe9f60ef3b9cd38d7eb912ce02e56a61837656210069bd9e2 | Hash of an archive containing GoFlateLoader x64 loading Vidar. |
| SHA256 | 4cf6893756f441522b94b36f10e5de0e47aeed4743f95c51650746d1ecf97e3d | Hash of a GoFlateLoader x64 sample loading SvitStealer. |
| SHA256 | 841c9297cb8a2e0ff89433d13c05bfc760eb2e98e251cb8fa785d2ad7cbac05f | Hash of an archive containing GoFlateLoader x86 loading Amatera. |
| SHA256 | 8b89d6c9152d3aab97aadd515ecb69ca72654db2f25425759ba4b646853d737d | Hash of a GoFlateLoader x86 sample loading Lumma. |
| SHA256 | 90ce4ff9da23ac150da0a8e17930cab1e369aa349fdc1b65691b70369145664a | Hash of a GoFlateLoader x86 sample loading Amatera. |
| SHA256 | b88c5744975d2abb447aecc6c090fee9f8580413f4612eecdc6ed1973e8a1739 | Hash of a password-protected archive containing GoFlateLoader x64 loading Remus. |
| SHA256 | d9917ade3b4c125a95b5d3e6343cde26145dfbf569bd7e2a843fd0c6fc8ddc28 | Hash of a GoFlateLoader x64 sample loading Remus. |
| SHA256 | ece7c48eb411b24f26762ede83badb4a644c41d5777129381ac2541804d64fc2 | Hash of an archive containing GoFlateLoader x86 loading Lumma. |
| SHA256 | ed5ae7f36453c5a23e9868a5729d67e0549a11f6dea54f5f52d654a8f51d4902 | Hash of an archive containing GoFlateLoader x64 loading Remus. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationGoFlateLoader decodes a custom multi-stage encoded payload and includes junk or decoy code that complicates static analysis.T1027.001 · Binary PaddingThe loader appends a massive PE overlay, typically producing files 700–950 MB in size, to hinder scanning and analysis.T1105 · Ingress Tool TransferGoFlateLoader is distributed through cracked-software paths and downloadable password-protected archives served from landing pages.T1106 · Native APIThe loader uses Windows APIs including VirtualAlloc, LoadLibrary, and GetProcAddress to allocate memory and rebuild the payload's imports.
Malware
Amatera StealerGen Threat Labs tracked GoFlateLoader, a widespread Golang loader that uses inflated PE overlays and manual in-memory execution to deliver infostealers such as Amatera, Remus, Lumma, Vidar, StealC, and SvitStealer.GoFlateLoaderGen Threat Labs tracked GoFlateLoader, a widespread Golang loader that uses inflated PE overlays and manual in-memory execution to deliver infostealers such as Amatera, Remus, Lumma, Vidar, StealC, and SvitStealer.LummaGen Threat Labs tracked GoFlateLoader, a widespread Golang loader that uses inflated PE overlays and manual in-memory execution to deliver infostealers such as Amatera, Remus, Lumma, Vidar, StealC, and SvitStealer.RemusGen Threat Labs tracked GoFlateLoader, a widespread Golang loader that uses inflated PE overlays and manual in-memory execution to deliver infostealers such as Amatera, Remus, Lumma, Vidar, StealC, and SvitStealer.StealCGen Threat Labs tracked GoFlateLoader, a widespread Golang loader that uses inflated PE overlays and manual in-memory execution to deliver infostealers such as Amatera, Remus, Lumma, Vidar, StealC, and SvitStealer.SvitStealerGen Threat Labs tracked GoFlateLoader, a widespread Golang loader that uses inflated PE overlays and manual in-memory execution to deliver infostealers such as Amatera, Remus, Lumma, Vidar, StealC, and SvitStealer.VidarGen Threat Labs tracked GoFlateLoader, a widespread Golang loader that uses inflated PE overlays and manual in-memory execution to deliver infostealers such as Amatera, Remus, Lumma, Vidar, StealC, and SvitStealer.
Vendors
Products
Countries
ArgentinaGen reports protecting more than 33,000 unique users since April, with notable impact in Brazil, India, Argentina, Mexico, Turkey, and Spain.BrazilGen reports protecting more than 33,000 unique users since April, with notable impact in Brazil, India, Argentina, Mexico, Turkey, and Spain.IndiaGen reports protecting more than 33,000 unique users since April, with notable impact in Brazil, India, Argentina, Mexico, Turkey, and Spain.MexicoGen reports protecting more than 33,000 unique users since April, with notable impact in Brazil, India, Argentina, Mexico, Turkey, and Spain.SpainGen reports protecting more than 33,000 unique users since April, with notable impact in Brazil, India, Argentina, Mexico, Turkey, and Spain.TurkeyGen reports protecting more than 33,000 unique users since April, with notable impact in Brazil, India, Argentina, Mexico, Turkey, and Spain.