GoFlateLoader: Golang Infostealer Loader Using Massive PE Overlay Inflation (700-950 MB) to Evade Antivirus and VirusTotal Scanning — Threadlinqs Intelligence
As of 2026-06-14, GoFlateLoader: Golang Infostealer Loader Using Massive PE Overlay Inflation (700-950 MB) to Evade Antivirus and VirusTotal Scanning is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 23 indicators of compromise.
Threat ID: TL-2026-0797 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
GoFlateLoader is a widespread Go-written information-stealer loader that artificially inflates its file size to 700-950 MB by appending a massive PE overlay of null bytes or random padding,
GoFlateLoader is a Golang-based malware loader whose defining characteristic is a deliberate file-size inflation technique. Each sample carries a massive PE overlay appended after the loader's legitimate PE structure, padding the binary to a consistent 700-950 MB with null bytes or random data. Because this consistently sits just above VirusTotal's strict 650 MB upload limit, researchers assess that VirusTotal and similarly size-limited automated scanning platforms are a specific evasion target. Despite the on-disk size, the overlay is highly compressible, so the distributed archives remain small and efficient to deliver. The loader supports both x86 (32-bit) and x86-64 (64-bit) variants, with bitness matched to the embedded payload.
Operationally, GoFlateLoader is an in-memory manual PE loader. It stores an encoded payload inside the binary's .rdata section, decodes it using a multi-stage custom byte-level transformation, allocates RWX memory via VirtualAlloc, maps the PE sections, applies base relocations, and resolves imports through standard IMAGE_IMPORT_DESCRIPTOR tables. The reconstructed payload never touches disk, defeating file-based detection that monitors on-disk artifacts. Execution is transferred to the payload entry point by abusing Go's syscall.Syscall(trap, nargs, a1, a2, a3) as a generic call gate, invoked with hardcoded dummy arguments (1, 2, 3, 4) — an unusual behavioral pattern that researchers highlight as a high-value detection marker. Notably, the loader carries no anti-debugging checks, no virtual-machine detection, and no sandbox-evasion logic, relying almost entirely on the overlay-inflation and in-memory tactics for stealth.
Distribution occurs through two primary vectors: fake cracked-software downloads, and a malicious traffic distribution system (TDS) recently documented by Check Point Research that redirects victims to landing pages offering password-protected archives, where the extraction password (e.g., 1234) is displayed separately so automated scanners cannot unpack and analyze the contents. The delivered payloads are commodity information stealers — Lumma, Vidar, StealC, Amatera, Remus, and SvitStealer — which harvest saved browser passwords, cookies, autofill and browser data, and cryptocurrency wallet credentials before exfiltrating them to their respective operator infrastructure. Gen Digital (Gen Threat Labs) identified and tracks the campaign, reporting 33,000+ protected unique users since April 2026, with the heaviest concentration in Brazil, India, Argentina, Mexico, Turkey, and Spain. No loader-specific C2 domains, IPs, or URLs were published; the eleven released indicators are SHA-256 file hashes of loader/archive samples mapped to their embedded stealer payloads.
Target sectors: consumer, technology, gaming, small-business
Target regions: South America, South Asia, Europe, Middle East, North America
Detections & IOCs
As of 2026-07-21, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 23 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583, T1608, T1588, T1587, T1189, T1204, T1106, T1129, T1027, T1027