Gootloader

Editor’s note: While the detection opportunities and analysis on this page are still relevant, it has not been updated since 2023. 

Analysis

Gootloader is a JScript-based malware family that typically leverages SEO poisoning and compromised websites to lure victims into downloading a ZIP archive that poses as a document that the user has searched for. While we observed Gootloader detections in customer environments across multiple sectors in 2022, they almost always happened after victims accessed compromised websites that claimed to offer information on contracts or other legal or financial documents. Victims were likely directed to these sites after initiating queries in common search engines with keywords such as “agreement,” “contract,” and the names of various financial institutions. Given the volume of Gootloader detections and the range of victims, this threat is likely more opportunistic than targeted to a specific industry or organization. Accordingly, Gootloader remains a threat to all organizations.

Upon execution, Gootloader identifies whether the affected system is connected to an Active Directory domain before deploying multiple stages of JScript and PowerShell payloads that may eventually lead to threats such as Cobalt Strike, Gootkit, Osiris, or Sodinokibi ransomware. Unremoved Gootloader infections have a strong possibility of leading to larger-scale incidents resulting in data theft or ransomware.

Readers of past Threat Detection Reports may recall that we previously tracked Gootloader together with the related Gootkit payload. While Gootloader sometimes delivers Gootkit as a payload, we began distinguishing the two in 2022 because we observed Gootloader sometimes delivered alternative payloads to Gootkit, such as Cobalt Strike, and often did not deliver a second-stage payload at all.

Adversaries using Gootloader in 2022 followed a consistent execution pattern, using wscript.exe and PowerShell command lines until around November, when they significantly changed multiple stages to use different Windows Registry keys for storage, a different process hierarchy, and more discovery commands. Some adversaries included cscript.exe for JScript execution instead of wscript.exe at some stages. This change enabled the adversary to spawn PowerShell without a command line to pipe in commands for execution via a StdIn stream. For more details, check out our blog from May (updated in November), which covers Gootloader activity in more depth.

To mitigate risks associated with the malicious JScript files used by Gootloader operators, we recommend preventing automatic execution of JScript files. You can do this by changing the default file associations for .js and .jse files.

To remove Gootloader components, stop any malicious instances of wscript.exe, cscript.exe, and powershell.exe. Remove any malicious scheduled tasks for the victim user to remediate persistence on the host. If any payloads were stored within the Windows Registry or on disk, attempt to remove those payloads for full remediation. Examples of these registry keys include:

• HKCU\SOFTWARE\Microsoft\Phone\%USERNAME%
• HKCU\SOFTWARE\Microsoft\Phone\%USERNAME%0
• HKCU\SOFTWARE\Microsoft\Personalization\%USERNAME%
• HKCU\SOFTWARE\Microsoft\Personalization\%USERNAME%0
• HKCU\SOFTWARE\Microsoft\Fax\%USERNAME%
• HKCU\SOFTWARE\Microsoft\Fax\%USERNAME%0
• HKCU\SOFTWARE\Microsoft\Personalization\%RANDOMVALUE%

Detection opportunities

Windows Scripting Host executing JScript files

Victims nearly always download Gootloader samples inside a ZIP archive distributed by an adversary. The most common initial execution pattern is for the victim to double click on the ZIP archive and execute the JScript file within. This produces a command line similar to:

WScript.exe "C:\Users\[redacted]\AppData\Local\Temp\Temp1_simple_agreement_for_future_equity_9891.zip\simple agreement for future equity 95886.js"

This pattern is also seen across other script-based threats distributed within ZIP archives. To detect this entire class of threat, you can start with this logic and tune: