Google Announces GoStringUngarbler Tool to Decrypt Go Based Malware

Google’s Mandiant subsidiary has unveiled GoStringUngarbler – an open-source deobfuscation framework designed to neutralize advanced string encryption techniques in Go-based malware. 

This innovation specifically targets binaries obfuscated using garble, an increasingly prevalent obfuscation compiler that has complicated malware analysis through sophisticated literal transformations and control flow manipulation.

Garble’s Obfuscation Architecture

The garble compiler implements Abstract Syntax Tree (AST) manipulation through Go’s go/ast library to transform source code during compilation while preserving program semantics.

Its -literals flag activates four principal string transformation methodologies:

Stack Transformations

This category employs three encryption variants:

Simple transformation: Using a randomly produced mathematical operator and a randomly generated key of identical length to the input string, this transformation applies byte-by-byte encoding.

Swap transformation: Byte-pair swapping and position-dependent encoding are combined in this transformation, which shuffles and encrypts byte pairs using locally generated keys.

Shuffle transformation: Multi-layer permutation involving index scrambling via obfRand.Perm and XOR-based position mapping.

Seed Transformation

Implements chained encryption where each byte’s decryption depends on previous operations through a continuously modified seed value.

The runtime implementation creates nested function call chains visible in decompilation outputs.

Split Transformation

Fragments strings into randomly sized chunks processed through a state machine built from switch statements.

Decryption involves reassembling chunks while applying position-dependent XOR keys derived from global encryption parameters.

GoStringUngarbler’s Deobfuscation Engine

Mendiant’s solution combines static pattern recognition with dynamic emulation to bypass garble’s defenses:

Subroutine Identification

The tool leverages instruction patterns around Go’s runtime_slicebytetostring function to detect decryption routines.

For x64 binaries, consistent register usage (RBX=string pointer, RCX=length) enables signature-based detection via regular expressions:

Unicorn-Based Emulation

Identified subroutines are executed in Unicorn Engine’s isolated environment to extract plaintext strings.

The framework handles garble’s stack manipulation and control flow redirections by emulating from subroutine prologues to runtime_slicebytetostring calls.

Binary Patching

Decrypted strings are reinjected into the binary using optimized assembly stubs that replace the original decryption logic.

This in-place patching strategy leverages garble’s stack allocations to store plaintext strings without section modifications.

Operational Impact

Early testing indicates GoStringUngarbler successfully processes binaries from Go v1.21–1.23 across PE/ELF formats.

The tool’s YARA rules (available on Mandiant’s GitHub) enable rapid identification of garble-protected samples.

For reverse engineers, the automated deobfuscation:

• Reduces manual debugging sessions for string extraction
• Exposes API calls, configuration parameters, and C2 fingerprints
• Facilitates faster malware family clustering

Future Development

While currently optimized for stack/shuffle transformations, Mandiant plans to expand support through:

• Modular plugin architecture for new Go compiler versions
• Enhanced handling of goroutine-based obfuscation
• Integration with IDA Pro/Ghidra via plugin APIs

Security teams can deploy GoStringUngarbler alongside existing EDR solutions to improve detection rates for garble-obfuscated malware. 

GoStringUngarbler is now available under the Apache 2.0 license on GitHub.

The tool’s release marks a critical advancement in countering the growing abuse of Go’s compilation ecosystem for offensive operations.

Collect Threat Intelligence on the Latest Malware and Phishing Attacks with ANY.RUN TI Lookup -> Try for free