Loading malware…
Gootkit is a modular Windows banking Trojan and information stealer first discovered in 2014. It targets online banking activity and sensitive information, supporting credential theft, browser-cookie collection, form grabbing, keylogging, screenshots, and exfiltration. Its man-in-the-browser functionality injects code into browser processes to modify web content, manipulate or redirect traffic, and facilitate unauthorized banking transactions. Victims have been concentrated in European countries, including Germany and Italy.
Gootkit combines a native C++ loader with a JavaScript main body executed through an embedded Node.js runtime. Its multistage architecture uses encrypted components, runtime string decryption, in-memory execution, and extensive anti-debugging and virtualization checks. Analyzed variants employ process hollowing, direct system calls, and Heaven’s Gate to complicate analysis and bypass conventional user-mode monitoring. Browser-injected components can modify certificate-validation behavior to support interception and web injection. Persistence mechanisms include abuse of Internet Explorer Administration Kit pending Group Policy processing and Windows services. The malware communicates with command-and-control infrastructure over HTTPS to report host information, retrieve components and updates, and transmit collected data.
Distribution has included malicious email attachments, obfuscated JavaScript downloaders, and exploit kits such as RIG and Spelevo. Gootkit has also been delivered through GootLoader, a distinct infection framework that uses compromised websites, search-engine poisoning, and deceptive download lures. Other delivery malware, including Sload and Emotet, has distributed Gootkit. Storm-0324 historically included it among its payloads, and Gootkit infections have appeared in access chains preceding REvil ransomware deployment.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
“Prior to this threat, Storm-0324 had the following range of payload distribution: ... Gootkit.”
We have observed final payloads including Ramnit, Gootkit, DarkVNC, Ursnif, and PsiXBot.
Delivered malware included ZLoader (a.k.a. Terdot), Gootkit, Ursnif, Corebot, Panda Banker, Atmos, Mazar Bot, and Red Alert Android malware.
59 distinct techniques documented for this family, organized by ATT&CK tactic.
The communication sends the mothership the following parameters of the initial request, all in base64 encoded form: a: Unique server ID b: IP address of the unsuspecting visitor c: user agent d: referrer string
In the cases we saw, the Gootkit loader initially arrives via a ZIP archive downloaded from a website. These malicious websites can be found in malicious search engine results.
Gootloader uses malicious search engine optimization (SEO) techniques to squirm into Google search results.
The attackers may simply obtain the sites’ passwords from the Gootkit malware itself, or from any of a number of criminal markets that trade in stolen credentials...
GootLoader is an initial access malware... It is delivered through drive-by social engineering attacks.
Most probably, it spreads through the recent vulnerability in Plesk Panel, so we would like to appeal to every web administrator and every hosting provider to update the Plesk software on their servers to the newest version.
Initially it was distributed via spam and exploits kits such as Spelevo and RIG.
The emails include ZIP attachments, pre-downloaded from the attacker’s server, containing a decoy PDF file and a malicious VBS file.
The emails are crafted in the targeted country’s language and are often personalized to include recipients’ names and addresses in various parts of the email such as email body and subject. TA554 frequently uses package delivery or order notification lures; the emails contain URLs linking to zipped LNK files or zipped documents.
I couldn’t find the process in Process Monitor for the task scheduling part... Here’s a snip of the Task that was added.
We additionally observed the creation of a scheduled task named “Business Aviation” with the command line “wscript REHABI~1.JS”... Persistence was obtained via CScript.exe executing the file SMALLU~1.js via a scheduled task named Destination Branding.
The Gootkit Banking Trojan was discovered back in 2014, and utilizes the Node.JS library to perform a range of malicious tasks.
Executing the VBS file leads to downloading further malware using a PowerShell command.
The emails include ZIP attachments... containing a decoy PDF file and a malicious VBS file. Executing the VBS file leads to downloading further malware using a PowerShell command.
The first stage download server, where a PHP script serves the first stage JScript downloader script... The first stage download script ( down.php or join.php or about.php or index.php ) simply relays the incoming request to the mothership.
The core component of Gootloader is a small js loader (2.8 KB) that acts as the first-stage of the infection chain.
Previous version of this malware was known for redirecting users to the BlackHole Exploit Kit.
| where InitiatingProcessFileName =~ "wscript.exe" and InitiatingProcessCommandLine has ".zip" and InitiatingProcessCommandLine has ".js"
I couldn’t find the process in Process Monitor for the task scheduling part... Here’s a snip of the Task that was added.
We additionally observed the creation of a scheduled task named “Business Aviation” with the command line “wscript REHABI~1.JS”... Persistence was obtained via CScript.exe executing the file SMALLU~1.js via a scheduled task named Destination Branding.
The attackers may simply obtain the sites’ passwords from the Gootkit malware itself, or from any of a number of criminal markets that trade in stolen credentials...
the loader tries to find registry keys with the following format: HKCU\Software\AppDataLow\<pr_string>_<i> ... Each key contains a maximum chunk of 512,000 bytes (500KB) of encrypted data. | So Gootkit creates an .inf file in the same directory as the sample and writes the following values to the Software\Microsoft\IEAK\GroupPolicy\PendingGPOs registry key
At this point we didn’t know exactly how the sites are compromised, but we knew from the report that malicious PHP code is somehow inserted into the WordPress installation.
This code contains a simple PHP command shell, which the Gootloader attackers can use to maintain access to compromised pages... If the compromised website receives an HTTPS POST with that string in it, the code on the page will decode and execute any base64 encoded commands it receives...
If the sample is running under another account, it creates a service with a random name chosen from %SystemRoot%, copies itself into the %SystemRoot% folder with the chosen name and deletes itself from the disk.
When explorer.exe is loaded at runtime, it will execute the [DefaultInstall] inside the created file, which will run the Gootkit executable.
The sample will create a registry key located at: Software\Microsoft\IEAK\GroupPolicy\PendingGPOs And then create three values inside this key: Count, Path1, and Section1.
To do so, the code patches standard browser functions responsible for certificate validation to allow self-signed certificates. As a result, attackers are able to inject custom JS code and modify or redirect traffic.
I couldn’t find the process in Process Monitor for the task scheduling part... Here’s a snip of the Task that was added.
We additionally observed the creation of a scheduled task named “Business Aviation” with the command line “wscript REHABI~1.JS”... Persistence was obtained via CScript.exe executing the file SMALLU~1.js via a scheduled task named Destination Branding.
iterates over the running processes and tries to inject the decrypted DLLs into the process memory of the designated process using the NtCreateSection/NtMapViewOfSection API.
The sample calls NtCreateSection, and will then map that section into the Browser using NtMapViewOfSection. Both DLLs seem to be mapped into memory as well, regardless of architecture.
It then performs a process hollowing on that executable to load the Delphi component.
Some versions of Gootkit are also able to launch the main body with administrator privileges bypassing UAC.
The attackers may simply obtain the sites’ passwords from the Gootkit malware itself, or from any of a number of criminal markets that trade in stolen credentials...
If the sample is running under another account, it creates a service with a random name chosen from %SystemRoot%, copies itself into the %SystemRoot% folder with the chosen name and deletes itself from the disk.
When explorer.exe is loaded at runtime, it will execute the [DefaultInstall] inside the created file, which will run the Gootkit executable.
The sample will create a registry key located at: Software\Microsoft\IEAK\GroupPolicy\PendingGPOs And then create three values inside this key: Count, Path1, and Section1.
To do so, the main loader created an SDB file and registered it in the system with the help of the sdbinst.exe utility, after which it launched the bot with elevated privileges without notifying the user.
The loader is composed of three highly obfuscated layers that contain encoded URLs.
A string analysis of the dropped file was not useful in identifying its intent, as the JavaScript was heavily obfuscated... The decoder also identified various malicious domain names within the obfuscated strings.
iterates over the running processes and tries to inject the decrypted DLLs into the process memory of the designated process using the NtCreateSection/NtMapViewOfSection API.
The sample calls NtCreateSection, and will then map that section into the Browser using NtMapViewOfSection. Both DLLs seem to be mapped into memory as well, regardless of architecture.
It then performs a process hollowing on that executable to load the Delphi component.
Finally, the original executable cleans up by deleting itself from disk and exiting, leaving the created service running.
The attackers may simply obtain the sites’ passwords from the Gootkit malware itself, or from any of a number of criminal markets that trade in stolen credentials...
Note that each “while” loop is performing string decryption on the sequences of bytes shown in the variables above the loop. When following the execution in a debugger, the strings are decrypted, and some meaningful indicators of VM checks are visible.
What Gootkit does is it creates a Pending GPO for the Internet Explorer Administration Kit (IEAK), which points directly at the INF file. When explorer.exe is loaded at runtime, it will execute the [DefaultInstall] inside the created file, which will execute the Gootkit executable.
the Gootkit loader employs lots of different methods to detect virtual environments or debuggers. If any of the virtual machine checks succeed, the loader enters an infinite loop.
The rest of the checks include: Compare user name to "CurrentUser"/"Sandbox" Compare computer name to "SANDBOX"/"7SILVIA" HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion" compare with AMI, VirtualBox, BOCHS, INTEL 640000, 55274-640-2673064-23950, and other serials
If Xeon is detected, Gootkit will enter an endless sleep-loop cycle... If any of the values match, it will enter an infinite sleep-loop cycle once again.
This code is, by default, loaded into memory.
Running the sample in a debugger allows us to interrupt the process and inspect its execution flow. Whenever the debugger is paused, Gootkit’s process is sleeping.
the loader tries to find registry keys with the following format: HKCU\Software\AppDataLow\<pr_string>_<i> ... Each key contains a maximum chunk of 512,000 bytes (500KB) of encrypted data. | So Gootkit creates an .inf file in the same directory as the sample and writes the following values to the Software\Microsoft\IEAK\GroupPolicy\PendingGPOs registry key
To do so, the code patches standard browser functions responsible for certificate validation to allow self-signed certificates. As a result, attackers are able to inject custom JS code and modify or redirect traffic.
Hackers are abusing Microsoft Defender Antivirus exclusions to keep malicious files outside routine security scans... attackers can leave antivirus running while creating gaps around malware staging folders and selected file types.
Interception of user data is done the standard way, via web injections into HTTPS traffic
Gootkit is capable of stealing data from the browser, performing man-in-the-browser attacks, keylogging, taking screenshots
Malware.js initializes global bot variables, collects saved cookies (IE, Firefox, Chromium)
SLAVE_PACKET_LSAAUTH Send authentication credentials
To do so, the code patches standard browser functions responsible for certificate validation to allow self-signed certificates. As a result, attackers are able to inject custom JS code and modify or redirect traffic.
Continuing on, Gootkit will query HARDWARE\DESCRIPTION\System\SystemBiosVersion and compare the value to; AMI, BOCHS, VBOX, QEMU... Yet another registry query is performed, this time with the key HARDWARE\Description\System\VideoBiosVersion.
The local user’s DNS domain is queried if the machine is joined to a domain, “Og13” will have 278146 added at the end.
Upload list of processes (P_SPYWARE:SP_PROCESSLIST)
Take note of the previously observed enumeration data that is GZIPd and then B64 encoded into the Cookie values.
the Gootkit loader employs lots of different methods to detect virtual environments or debuggers. If any of the virtual machine checks succeed, the loader enters an infinite loop.
The rest of the checks include: Compare user name to "CurrentUser"/"Sandbox" Compare computer name to "SANDBOX"/"7SILVIA" HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion" compare with AMI, VirtualBox, BOCHS, INTEL 640000, 55274-640-2673064-23950, and other serials
If Xeon is detected, Gootkit will enter an endless sleep-loop cycle... If any of the values match, it will enter an infinite sleep-loop cycle once again.
Running the sample in a debugger allows us to interrupt the process and inspect its execution flow. Whenever the debugger is paused, Gootkit’s process is sleeping.
The response in this case will contain detailed information about the infected computer, including: Network adapter parameters; CPU details, amount of RAM; User name, computer name.
Interception of user data is done the standard way, via web injections into HTTPS traffic
Gootkit is capable of stealing data from the browser, performing man-in-the-browser attacks, keylogging, taking screenshots
Gootkit is capable of stealing data from the browser, performing man-in-the-browser attacks, keylogging, taking screenshots
The injected code is called from the main body web injection and traffic sniffing routines to perform a man-in-the-browser attack.
Indicators of Compromise ... jonathanbartz[.]com Command and Control
Communication with the C&C comes down to the exchange of a pre-defined set of commands... While generating a request, the Trojan uses its unique User Agent
Gootloader, which attempts to retrieve the final payload, whether it be ransomware, a banking trojan or intrusion tool/credential stealer.
Take note of the previously observed enumeration data that is GZIPd and then B64 encoded into the Cookie values.
Recently, we came across web malware that – instead of injecting an iframe pointing to a fixed existing address – generates a pseudo-random domain name, depending on the current date. This approach is not new and is widely used by botnets in C&C domain name generation.
FakeNet showed various domain names being reached out to with GET /xmlrpc.php HTTP/1.1 requests via Powershell.exe. The requests contained Base64-encoded cookies... showing enumeration information regarding device directories and host information.
Terminate process (P_SPYWARE:SP_PROCESSKILL)
115 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
64 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.