BEGIN:VCALENDAR
PRODID:-//Google Inc//Google Calendar 70.9054//EN
VERSION:2.0
CALSCALE:GREGORIAN
METHOD:PUBLISH
X-WR-CALNAME:44CON 2026
X-WR-TIMEZONE:Europe/London
BEGIN:VEVENT
DTSTART:20260917T101000Z
DTEND:20260917T110000Z
DTSTAMP:20260625T133935Z
UID:0s2ddluef7kl5h6lmjaeh4cm9r@google.com
CREATED:20260624T101521Z
DESCRIPTION:GoGra is an interesting backdoor family which emerged in 202
 4\, mostly targeting India and Afghanistan.\nIn April 2026\, its develope
 rs released a Linux variant with several smart mechanisms: an implant hidde
 n in the dropper ELF binary\, abuse of the Microsoft Graph API as an email-
 based dead-drop C2.\n\nIn this talk\, we detail the interesting function
 alities of GoGra (e.g how the implant is hidden\, how emails are encrypted)
 \, but also how we performed the reverse engineering. Indeed\, as the name 
 suggests\, GoGra is implemented in Go.\nMalware analysis of stripped Go b
 inaries is known to be painful: numerous unnamed functions\, presence of ru
 ntime and library code\, wrappers\, specific ABI conventions which confuse 
 disassemblers etc.\n\nConsequently\, we assisted our reverse engineering
  with AI\, with a setup of OpenCode\, Ghidra MCP and specific agents and sk
 ills. The good (?) news is that this is not a "single-click analysis" where
  the AI does all the work and we just sit and look. We have to guide LLMs t
 o answer our questions. For example\, I provided a "crash course" at revers
 ing Go to the LLM\, and working from that it was able to generate a useful 
 Ghidra script to parse the pclntab (this is a table which maps instruction 
 addresses to function names).\n\nThe talk continues with a workshop on "
 Reverse engineering with AI"\, where the audience learns how to setup binar
 y disassembly with AI. The workshop consists of a collection of CrackMe or 
 CTF binaries to reverse.\nParticipants learn to setup OpenCode\, MCPs for
  Ghidra and Radare2. They experience with permissions\, creation of agents 
 and skills for reverse engineering. The workshop is tailored to be used wit
 h free API keys from various providers. The results are even better if part
 icipants can afford a paid subscription\, but it is not mandatory.
LAST-MODIFIED:20260625T133924Z
LOCATION:Track 1
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:Inside Linux GoGra backdoor – Axelle Apvrille
TRANSP:OPAQUE
END:VEVENT
END:VCALENDAR