When Obfuscation Becomes the Signature: Static Analysis of a Go-Based Linux RAT
Static analysis of a Go-based Linux RAT (Warp/Wraith family, SHA256: 3bfc4394…) that manipulates its ELF structure to evade analysis tools. Three structural anomalies — section header table past EOF, oversized PT_LOAD segment, and dynamic linking on a Go binary — produce an immediate malicious verdict before any disassembly runs. String analysis identifies SSH/SFTP credential harvesting, /bin/systemd-worker process masquerading, and a related 736KB variant (e097c852…) with embedded coinminer payload. Detected via static ELF header inspection alone, no sandbox required.
