# GoFlateLoader: Golang Infostealer Loader Using Massive PE Overlay Inflation (700-950 MB) to Evade Antivirus and VirusTotal Scanning

> GoFlateLoader is a widespread Go-written information-stealer loader that artificially inflates its file size to 700-950 MB by appending a massive PE overlay of null bytes or random padding, deliberately exceeding VirusTotal's 650 MB upload limit and the file-size scanning thresholds of many AV engines. It performs in-memory manual PE loading of multiple commodity infostealers (Lumma, Vidar, StealC, Amatera, Remus, SvitStealer) and is distributed via fake cracked software and a malicious traffic distribution system (TDS). Gen Digital (Gen Threat Labs) reports protecting 33,000+ unique users since April 2026, concentrated in Brazil, India, Argentina, Mexico, Turkey, and Spain.

- **Published:** 2026-06-14T00:00:00Z
- **Last reviewed:** 2026-06-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0797
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-goflateloader-pe-overlay-tl-2026-0797.webp?v=315c5c90 (Threadlinqs threat intel: GoFlateLoader 700-950 MB PE Overlay: Detection & IOCs (TL-2026-0797) — High severity, 23 IOCs, 9 detection rules.)
- **ID:** TL-2026-0797
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 23 (3 shown free below)

## Description

GoFlateLoader is a Golang-based malware loader whose defining characteristic is a deliberate file-size inflation technique. Each sample carries a massive PE overlay appended after the loader's legitimate PE structure, padding the binary to a consistent 700-950 MB with null bytes or random data. Because this consistently sits just above VirusTotal's strict 650 MB upload limit, researchers assess that VirusTotal and similarly size-limited automated scanning platforms are a specific evasion target. Despite the on-disk size, the overlay is highly compressible, so the distributed archives remain small and efficient to deliver. The loader supports both x86 (32-bit) and x86-64 (64-bit) variants, with bitness matched to the embedded payload.

Operationally, GoFlateLoader is an in-memory manual PE loader. It stores an encoded payload inside the binary's .rdata section, decodes it using a multi-stage custom byte-level transformation, allocates RWX memory via VirtualAlloc, maps the PE sections, applies base relocations, and resolves imports through standard IMAGE_IMPORT_DESCRIPTOR tables. The reconstructed payload never touches disk, defeating file-based detection that monitors on-disk artifacts. Execution is transferred to the payload entry point by abusing Go's syscall.Syscall(trap, nargs, a1, a2, a3) as a generic call gate, invoked with hardcoded dummy arguments (1, 2, 3, 4) — an unusual behavioral pattern that researchers highlight as a high-value detection marker. Notably, the loader carries no anti-debugging checks, no virtual-machine detection, and no sandbox-evasion logic, relying almost entirely on the overlay-inflation and in-memory tactics for stealth.

Distribution occurs through two primary vectors: fake cracked-software downloads, and a malicious traffic distribution system (TDS) recently documented by Check Point Research that redirects victims to landing pages offering password-protected archives, where the extraction password (e.g., 1234) is displayed separately so automated scanners cannot unpack and analyze the contents. The delivered payloads are commodity information stealers — Lumma, Vidar, StealC, Amatera, Remus, and SvitStealer — which harvest saved browser passwords, cookies, autofill and browser data, and cryptocurrency wallet credentials before exfiltrating them to their respective operator infrastructure. Gen Digital (Gen Threat Labs) identified and tracks the campaign, reporting 33,000+ protected unique users since April 2026, with the heaviest concentration in Brazil, India, Argentina, Mexico, Turkey, and Spain. No loader-specific C2 domains, IPs, or URLs were published; the eleven released indicators are SHA-256 file hashes of loader/archive samples mapped to their embedded stealer payloads.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1588 Obtain Capabilities
- T1587 Develop Capabilities
- T1189 Drive-by Compromise
- T1204 User Execution
- T1106 Native API
- T1129 Shared Modules
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1055 Process Injection
- T1036 Masquerading
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**GoFlateLoader Infostealer Payload — Browser Credential/Cookie Harvest + C2 Exfiltration (C2/Collection)** (`TL-2026-0797-SPL-003`)

Detects post-load infostealer behavior from the GoFlateLoader-delivered payloads (Lumma, Vidar, StealC, Amatera, Remus, SvitStealer): bulk access to browser credential stores, cookie databases, and cryptocurrency wallet files, followed by outbound web (HTTP/S) exfiltration. Targets the credential-theft and C2 stages (T1555.003 Credentials from Web Browsers, T1539 Steal Web Session Cookie, T1071.001 Web Protocols, T1041 Exfiltration Over C2 Channel).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1555.003, T1539, T1071.001, T1041, T1005
- **Data sources:** sysmon, microsoft_defender_for_endpoint, windows_file_event, network_telemetry
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 OR EventCode=1
```Browser credential/cookie/wallet store access by non-browser process```
| eval cred_store=if(match(TargetFilename,"(?i)(Login Data|Cookies|Web Data|Local State|key4\.db|logins\.json|\\\\(Local|Roaming)\\\\.*(Wallet|wallet\.dat|Electrum|Exodus|Ledger))"),1,0)
| where cred_store=1
| eval browser_proc=if(match(Image,"(?i)(chrome|msedge|firefox|brave|opera)\.exe$"),1,0)
| where browser_proc=0
| stats count dc(TargetFilename) as distinct_stores values(TargetFilename) as files min(_time) as firstSeen by host, Image, ProcessGuid
| where distinct_stores>=2
```Correlate to outbound web exfil from the same process```
| join type=left host, ProcessGuid [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3 | eval is_web=if(DestinationPort IN(80,443,8080),1,0) | where is_web=1 | stats values(DestinationIp) as c2_ips by host, ProcessGuid ]
| sort - count
````

### Microsoft KQL

```kql
// GoFlateLoader-delivered infostealer: browser credential theft + exfil (Defender for Endpoint)
let credAccess =
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FileName in~ ("Login Data","Cookies","Web Data","Local State","key4.db","logins.json","wallet.dat")
         or FolderPath matches regex @"(?i)(Electrum|Exodus|Ledger|Coinbase)"
    | where InitiatingProcessFileName !in~ ("chrome.exe","msedge.exe","firefox.exe","brave.exe","opera.exe")
    | summarize StoresTouched=dcount(FileName), Files=make_set(FileName, 20), StartTime=min(Timestamp)
        by DeviceName, InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessSHA256
    | where StoresTouched >= 2;
credAccess
| join kind=leftouter (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemotePort in (80, 443, 8080)
    | summarize C2=make_set(RemoteUrl, 20), RemoteIPs=make_set(RemoteIP, 20) by DeviceName, InitiatingProcessId
  ) on DeviceName, InitiatingProcessId
| project StartTime, DeviceName, InitiatingProcessFileName, InitiatingProcessSHA256, StoresTouched, Files, C2, RemoteIPs
| sort by StoresTouched desc
```

### Sigma

```yaml
title: GoFlateLoader Infostealer Browser Credential and Cookie Store Harvest
id: 8b3c4d5e-6f7a-4c8d-9e0f-2a3b4c5d6e7f
status: experimental
description: Detects a non-browser process reading multiple browser credential, cookie, and cryptocurrency wallet stores, consistent with the Lumma/Vidar/StealC/Amatera/Remus/SvitStealer payloads delivered by GoFlateLoader.
references:
    - https://www.gendigital.com/blog/insights/research/goflateloader-delivers-multiple-infostealers
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/14
tags:
    - attack.credential_access
    - attack.t1555.003
    - attack.t1539
    - attack.collection
    - attack.t1005
logsource:
    category: file_event
    product: windows
detection:
    selection_files:
        TargetFilename|contains:
            - '\\Login Data'
            - '\\Cookies'
            - '\\Web Data'
            - '\\Local State'
            - '\\key4.db'
            - '\\logins.json'
            - 'wallet.dat'
    filter_browser:
        Image|endswith:
            - '\\chrome.exe'
            - '\\msedge.exe'
            - '\\firefox.exe'
            - '\\brave.exe'
            - '\\opera.exe'
    condition: selection_files and not filter_browser
falsepositives:
    - Backup, sync, or password-manager utilities accessing browser profile data
    - Endpoint forensics/DLP agents reading browser stores
level: high
```

**Known false positives:**

- Backup/sync utilities or password managers reading browser profiles
- Forensics/DLP agents accessing credential stores

**Tuning notes:** Allowlist legitimate password managers, browser-sync, and backup agents by signer/path. Raise the distinct-store threshold (>=2) to >=3 in noisy environments. Correlate the credential-access process with the GoFlateLoader loader process and any subsequent web POST exfil to escalate confidence; enrich destination IPs/URLs against C2 threat intel.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- GoFlateLoader Delivery — Cracked-Software Archive Extraction and User Execution of Oversized Binary (Exploitation) (locked: unlock with TL Creds)
- GoFlateLoader In-Memory PE Load — .rdata Decode + RWX Region Execution Without On-Disk Module (Post-Exploitation) (locked: unlock with TL Creds)
- GoFlateLoader Stealer C2 — Local Data Collection Followed by Web-Protocol Exfiltration / Ingress Tool Transfer (C2) (locked: unlock with TL Creds)
- GoFlateLoader Known-Sample Hash and Oversized Go PE Sighting (Exploitation) (locked: unlock with TL Creds)
- GoFlateLoader syscall.Syscall Call-Gate With Dummy Args + RWX Allocation (Post-Exploitation) (locked: unlock with TL Creds)
- GoFlateLoader Delivery + Stealer Credential Theft Chain (C2/Lateral Movement Stage) (locked: unlock with TL Creds)
- GoFlateLoader Overlay Inflation — Oversized PE/Archive Above VirusTotal 650 MB Limit (Exploitation/Delivery) (locked: unlock with TL Creds)
- GoFlateLoader Reflective Load — RWX VirtualAlloc + syscall.Syscall Call-Gate by Go Binary (Post-Exploitation) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 23)

Defanged, TLP:CLEAR.

- File hash: `b88c5744975d2abb447aecc6c090fee9f8580413f4612eecdc6ed1973e8a1739`
- File hash: `ed5ae7f36453c5a23e9868a5729d67e0549a11f6dea54f5f52d654a8f51d4902`
- File hash: `841c9297cb8a2e0ff89433d13c05bfc760eb2e98e251cb8fa785d2ad7cbac05f`

Full set of 23 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [GoFlateLoader: A Widespread Golang Loader Delivering Multiple Infostealers](https://www.gendigital.com/blog/insights/research/goflateloader-delivers-multiple-infostealers)
- [GoFlateLoader Uses Massive PE Overlay to Deliver Lumma, Vidar, and StealC Infostealers](https://cybersecuritynews.com/goflateloader-uses-massive-pe-overlay/)
- [GoFlateLoader Hides Infostealers in Massive PE Overlay](https://gbhackers.com/goflateloader-hides-infostealers/)
- [Hackers Spread GoFlateLoader Through Cracked Software and Malicious TDS Campaigns](https://cyberpress.org/cracked-software-spreads-goflateloader/)
- [GoFlateLoader: A Widespread Golang Loader Delivering Multiple Infostealers (A Gen-D Research) — MalwareTips](https://malwaretips.com/threads/goflateloader-%E2%80%AFa-widespread-golang-loader-delivering-multiple-infostealers-a-gen-d-research.141783/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0797