GoFlateLoader: Golang Infostealer Loader Using Massive PE Overlay Inflation (700-950 MB) to Evade Antivirus and VirusTotal Scanning

Key facts for GoFlateLoader PE overlay

Detection coverage for GoFlateLoader PE overlay

As of 2026-06-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0797 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: GoFlateLoader Infostealer Payload — Browser Credential/Cookie Harvest + C2 Exfiltration (C2/Collection)

Detects post-load infostealer behavior from the GoFlateLoader-delivered payloads (Lumma, Vidar, StealC, Amatera, Remus, SvitStealer): bulk access to browser credential stores, cookie databases, and cryptocurrency wallet files, followed by outbound web (HTTP/S) exfiltration. Targets the credential-theft and C2 stages (T1555.003 Credentials from Web Browsers, T1539 Steal Web Session Cookie, T1071.001 Web Protocols, T1041 Exfiltration Over C2 Channel).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1555.003, T1539, T1071.001, T1041, T1005
• Data sources: sysmon, microsoft_defender_for_endpoint, windows_file_event, network_telemetry
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 OR EventCode=1
```Browser credential/cookie/wallet store access by non-browser process```
| eval cred_store=if(match(TargetFilename,"(?i)(Login Data|Cookies|Web Data|Local State|key4\.db|logins\.json|\\\\(Local|Roaming)\\\\.*(Wallet|wallet\.dat|Electrum|Exodus|Ledger))"),1,0)
| where cred_store=1
| eval browser_proc=if(match(Image,"(?i)(chrome|msedge|firefox|brave|opera)\.exe$"),1,0)
| where browser_proc=0
| stats count dc(TargetFilename) as distinct_stores values(TargetFilename) as files min(_time) as firstSeen by host, Image, ProcessGuid
| where distinct_stores>=2
```Correlate to outbound web exfil from the same process```
| join type=left host, ProcessGuid [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3 | eval is_web=if(DestinationPort IN(80,443,8080),1,0) | where is_web=1 | stats values(DestinationIp) as c2_ips by host, ProcessGuid ]
| sort - count

Microsoft KQL

// GoFlateLoader-delivered infostealer: browser credential theft + exfil (Defender for Endpoint)
let credAccess =
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FileName in~ ("Login Data","Cookies","Web Data","Local State","key4.db","logins.json","wallet.dat")
         or FolderPath matches regex @"(?i)(Electrum|Exodus|Ledger|Coinbase)"
    | where InitiatingProcessFileName !in~ ("chrome.exe","msedge.exe","firefox.exe","brave.exe","opera.exe")
    | summarize StoresTouched=dcount(FileName), Files=make_set(FileName, 20), StartTime=min(Timestamp)
        by DeviceName, InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessSHA256
    | where StoresTouched >= 2;
credAccess
| join kind=leftouter (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemotePort in (80, 443, 8080)
    | summarize C2=make_set(RemoteUrl, 20), RemoteIPs=make_set(RemoteIP, 20) by DeviceName, InitiatingProcessId
  ) on DeviceName, InitiatingProcessId
| project StartTime, DeviceName, InitiatingProcessFileName, InitiatingProcessSHA256, StoresTouched, Files, C2, RemoteIPs
| sort by StoresTouched desc

Sigma

title: GoFlateLoader Infostealer Browser Credential and Cookie Store Harvest
id: 8b3c4d5e-6f7a-4c8d-9e0f-2a3b4c5d6e7f
status: experimental
description: Detects a non-browser process reading multiple browser credential, cookie, and cryptocurrency wallet stores, consistent with the Lumma/Vidar/StealC/Amatera/Remus/SvitStealer payloads delivered by GoFlateLoader.
references:
    - https://www.gendigital.com/blog/insights/research/goflateloader-delivers-multiple-infostealers
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/14
tags:
    - attack.credential_access
    - attack.t1555.003
    - attack.t1539
    - attack.collection
    - attack.t1005
logsource:
    category: file_event
    product: windows
detection:
    selection_files:
        TargetFilename|contains:
            - '\\Login Data'
            - '\\Cookies'
            - '\\Web Data'
            - '\\Local State'
            - '\\key4.db'
            - '\\logins.json'
            - 'wallet.dat'
    filter_browser:
        Image|endswith:
            - '\\chrome.exe'
            - '\\msedge.exe'
            - '\\firefox.exe'
            - '\\brave.exe'
            - '\\opera.exe'
    condition: selection_files and not filter_browser
falsepositives:
    - Backup, sync, or password-manager utilities accessing browser profile data
    - Endpoint forensics/DLP agents reading browser stores
level: high

Known false positives:

• Backup/sync utilities or password managers reading browser profiles
• Forensics/DLP agents accessing credential stores

Tuning notes: Allowlist legitimate password managers, browser-sync, and backup agents by signer/path. Raise the distinct-store threshold (>=2) to >=3 in noisy environments. Correlate the credential-access process with the GoFlateLoader loader process and any subsequent web POST exfil to escalate confidence; enrich destination IPs/URLs against C2 threat intel.

• 🔒 GoFlateLoader Delivery — Cracked-Software Archive Extraction and User Execution of Oversized Binary (Exploitation) · unlock with TL Creds
• 🔒 GoFlateLoader In-Memory PE Load — .rdata Decode + RWX Region Execution Without On-Disk Module (Post-Exploitation) · unlock with TL Creds
• 🔒 GoFlateLoader Stealer C2 — Local Data Collection Followed by Web-Protocol Exfiltration / Ingress Tool Transfer (C2) · unlock with TL Creds
• 🔒 GoFlateLoader Known-Sample Hash and Oversized Go PE Sighting (Exploitation) · unlock with TL Creds
• 🔒 GoFlateLoader syscall.Syscall Call-Gate With Dummy Args + RWX Allocation (Post-Exploitation) · unlock with TL Creds
• 🔒 GoFlateLoader Delivery + Stealer Credential Theft Chain (C2/Lateral Movement Stage) · unlock with TL Creds
• 🔒 GoFlateLoader Overlay Inflation — Oversized PE/Archive Above VirusTotal 650 MB Limit (Exploitation/Delivery) · unlock with TL Creds
• 🔒 GoFlateLoader Reflective Load — RWX VirtualAlloc + syscall.Syscall Call-Gate by Go Binary (Post-Exploitation) · unlock with TL Creds

Indicators of compromise for GoFlateLoader PE overlay

As of 2026-06-14, Threadlinqs Intelligence tracks 23 indicators of compromise for TL-2026-0797.

Sample indicators (3 of 23)

• File hash: b88c5744975d2abb447aecc6c090fee9f8580413f4612eecdc6ed1973e8a1739
• File hash: ed5ae7f36453c5a23e9868a5729d67e0549a11f6dea54f5f52d654a8f51d4902
• File hash: 841c9297cb8a2e0ff89433d13c05bfc760eb2e98e251cb8fa785d2ad7cbac05f

Defanged, TLP:CLEAR. Full set of 23 indicators: unlock with TL Creds.

How GoFlateLoader PE overlay works

It performs in-memory manual PE loading of multiple commodity infostealers (Lumma, Vidar, StealC, Amatera, Remus, SvitStealer) and is distributed via fake cracked software and a malicious traffic distribution system (TDS). Gen Digital (Gen Threat Labs) reports protecting 33,000+ unique users since April 2026, concentrated in Brazil, India, Argentina, Mexico, Turkey, and Spain.

GoFlateLoader is a Golang-based malware loader whose defining characteristic is a deliberate file-size inflation technique. Each sample carries a massive PE overlay appended after the loader's legitimate PE structure, padding the binary to a consistent 700-950 MB with null bytes or random data. Because this consistently sits just above VirusTotal's strict 650 MB upload limit, researchers assess that VirusTotal and similarly size-limited automated scanning platforms are a specific evasion target. Despite the on-disk size, the overlay is highly compressible, so the distributed archives remain small and efficient to deliver. The loader supports both x86 (32-bit) and x86-64 (64-bit) variants, with bitness matched to the embedded payload.

Operationally, GoFlateLoader is an in-memory manual PE loader. It stores an encoded payload inside the binary's .rdata section, decodes it using a multi-stage custom byte-level transformation, allocates RWX memory via VirtualAlloc, maps the PE sections, applies base relocations, and resolves imports through standard IMAGE_IMPORT_DESCRIPTOR tables. The reconstructed payload never touches disk, defeating file-based detection that monitors on-disk artifacts. Execution is transferred to the payload entry point by abusing Go's syscall.Syscall(trap, nargs, a1, a2, a3) as a generic call gate, invoked with hardcoded dummy arguments (1, 2, 3, 4) — an unusual behavioral pattern that researchers highlight as a high-value detection marker. Notably, the loader carries no anti-debugging checks, no virtual-machine detection, and no sandbox-evasion logic, relying almost entirely on the overlay-inflation and in-memory tactics for stealth.

Distribution occurs through two primary vectors: fake cracked-software downloads, and a malicious traffic distribution system (TDS) recently documented by Check Point Research that redirects victims to landing pages offering password-protected archives, where the extraction password (e.g., 1234) is displayed separately so automated scanners cannot unpack and analyze the contents. The delivered payloads are commodity information stealers — Lumma, Vidar, StealC, Amatera, Remus, and SvitStealer — which harvest saved browser passwords, cookies, autofill and browser data, and cryptocurrency wallet credentials before exfiltrating them to their respective operator infrastructure. Gen Digital (Gen Threat Labs) identified and tracks the campaign, reporting 33,000+ protected unique users since April 2026, with the heaviest concentration in Brazil, India, Argentina, Mexico, Turkey, and Spain. No loader-specific C2 domains, IPs, or URLs were published; the eleven released indicators are SHA-256 file hashes of loader/archive samples mapped to their embedded stealer payloads.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading

Exfiltration

T1041 Exfiltration Over C2 Channel

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

Discovery

T1082 System Information Discovery; T1518 Software Discovery

Execution

T1106 Native API; T1129 Shared Modules; T1204 User Execution

Initial Access

T1189 Drive-by Compromise

Credential Access

T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores

Resource Development

T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1588 Obtain Capabilities; T1608 Stage Capabilities

Remediation for GoFlateLoader PE overlay

Immediate actions

• Block and hunt for the 11 published GoFlateLoader SHA-256 hashes across EDR/AV inventories
• Block downloads of cracked/pirated software and warez archives at the web proxy and DNS layer
• Alert on execution of unusually large (700 MB - 1 GB+) PE files, especially Go-compiled binaries
• Quarantine endpoints exhibiting in-memory PE loading with RWX VirtualAlloc immediately followed by syscall.Syscall call-gate behavior

Workarounds

• Configure security tooling to treat samples exceeding scanner size limits as suspicious rather than benign
• Disable browser password/credit-card saving in managed environments to reduce stealer yield

Longer-term hardening

• Deploy EDR with in-memory/behavioral detection that does not rely on file-size-limited static scanning
• Remove file-size caps or add a large-file analysis path so oversized samples are not silently skipped
• Restrict execution of unsigned binaries from user-writable and download directories via application control (WDAC/AppLocker)
• Deploy browser credential-theft monitoring and enforce hardware-backed or phishing-resistant MFA to blunt stealer-harvested credentials

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: Windows endpoints running x86 and x64 PE executables

Timeline of GoFlateLoader PE overlay

• 2026-04-01 Earliest observed locked-ioc-17 activity; Gen Digital begins protecting affected users (campaign active since at least April 2026).
• 2026-04-15 Loader distributed via fake cracked-software downloads and a malicious traffic distribution system (TDS) serving password-protected archives.
• 2026-05-01 Multiple commodity infostealers observed delivered by the loader: locked-ioc-21, locked-ioc-22, locked-ioc-20, locked-ioc-19, locked-ioc-23, and locked-ioc-18 across x86 and x64 variants.
• 2026-05-20 Telemetry indicates 33,000+ unique users protected, concentrated in Brazil, India, Argentina, Mexico, Turkey, and Spain.
• 2026-06-11 Gen Digital (Gen Threat Labs) publicly documents locked-ioc-17, its 700-950 MB PE-overlay evasion, in-memory PE loading, and 11 SHA-256 IOCs; widely reported by Cyber Security News, GBHackers, and Cyberpress.
• 2026-06-14 Threat ingested and analyzed into the Threadlinqs Intelligence Platform.

Sources cited for GoFlateLoader PE overlay

• GoFlateLoader: A Widespread Golang Loader Delivering Multiple Infostealers gendigital.com · Research · 2026-06-11
• GoFlateLoader: A Widespread Golang Loader Delivering Multiple Infostealers (A Gen-D Research) — MalwareTips malwaretips.com · Blog · 2026-06-11
• GoFlateLoader Uses Massive PE Overlay to Deliver Lumma, Vidar, and StealC Infostealers cybersecuritynews.com · News · 2026-06-11
• GoFlateLoader Hides Infostealers in Massive PE Overlay gbhackers.com · News · 2026-06-11
• Hackers Spread GoFlateLoader Through Cracked Software and Malicious TDS Campaigns cyberpress.org · News · 2026-06-11

More in malware

• YobaLoader Campaign: DLL Sideloading in Signed OpenAI/Anthropic-Themed Binaries via Fake GitHub Repositories Delivering XMRig
• Radio Exploit Kit drive-by download campaign exploiting CVE-2016-0189 to deliver AZORult
• Bottle Exploit Kit (BottleEK) - Malvertising Campaign Targeting Japanese Users via CVE-2018-8174 and CVE-2018-15982
• Exploit kits remain active in April 2021: RIG, Spelevo, PurpleFox, Underminer, Bottle, Magnitude targeting Internet Explorer (CVE-2020-0674, CVE-2021-26411, CVE-2018-8174, CVE-2018-15982, CVE-2020-1380)
• Fake Security Tools on GitHub Deliver AsyncRAT, Clipper and Infostealer via Trojan.Loader.3261 Electron Loader (Microsoft.exe)

Previous and next in malware

• Abuse of Legitimate NinjaOne RMM Agent in Fiscal-Lure Phishing Campaign Targeting Brazilian Organizations (Cato CTRL) Previous report
• Malware Distribution Platform Exposed via Unsecured /install/install.php Setup Page (micronsoftwares[.]com / wetransfer[.]ICU SEO-Poisoning Operation) Next report