Goffloader, a pure Go implementation of an in-memory COFFLoader and PE loader, has been released to execute Cobalt Strike BOFs and unmanaged PE files directly in memory. By expanding Go’s security capabilities and avoiding CGO complications, Goffloader allows integration into Go-based security tools. Needing improvement, the COFFLoader only supports x64 architecture, and PE execution has hardcoded arguments. The library will not produce a 0/N detection file on VirusTotal. This tool is open-sourced in support of Praetorian’s Chariot BAS offering.
Cyber attackers use images & built-in tools to bypass defences – SecurityBrief Australia
Cyber attackers use images & built-in tools to bypass defences SecurityBrief Australia
