TencShell - Reflective Go Loader Thread (T1620)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•1

Detects local memory allocations changing state to PAGE_EXECUTE_READWRITE inside Go-compiled executables to execute shellcode. This behavior is indicative of reflective code loading, often used by malware to evade detection.