Mac Malware Minutes - Cthulhu Stealer Golang Strings in arm64

In this video, we will focus on how Golang strings are setup in arm64 using a macOS stealer called Cthulhu which got some coverage recently.
Golang strings differ from C strings since they are not null terminated and are actually structs with a pointer and length. This can make it difficult for tools to properly parse them.
Understanding how they work from an arm64 perspective allows you to more easily annotate as you reverse engineer go binaries.