Go-compiled Spyware DLL with Obfuscated Functions and Suspicious Structure
This rule set detects Go-compiled DLLs exhibiting characteristics often associated with spyware. The rules look for a combination of indicators including: specific build IDs and strings, suspicious Go package structures (e.g., 'considerations/'), obfuscated Go function names (e.g., 'main.main.candidateazerbaijanassessments' and regex patterns for long, random-looking function names), obfuscated Go structure names (e.g., 'main.Associatesstructure'), and suspicious communication/encryption-related strings (e.g., 'communication_key', 'ENCRYPTED_COMMAND', 'QUANTUM_ENCRYPTED'). The rules collectively aim to identify malicious Go DLLs that attempt to hide their functionality through obfuscation and use specific patterns for command and control or data exfiltration.
YARA
