Loading malware…
Gootkit is a Windows banking trojan and modular malware platform first identified in 2014. It began as a banking-focused threat and later expanded into a broader information-stealing and post-compromise framework. The malware is notable for a multi-stage architecture that combines a native loader with a JavaScript-based main body executed through an embedded Node.js runtime, as well as extensive anti-analysis and anti-virtualization logic intended to frustrate sandboxing and reverse engineering.
Gootkit has historically been used to steal browser data and authentication material, collect cookies, capture keystrokes, take screenshots, and perform form grabbing and web-injection activity associated with man-in-the-browser operations. It has also been observed modifying browser traffic and patching certificate-validation logic inside targeted browser processes to facilitate interception and manipulation of encrypted sessions. Reported browser targets include major Chromium-based browsers, Firefox, Internet Explorer, Edge, Opera, and Safari on Windows. The malware communicates with command-and-control infrastructure using custom packet formats and supports exfiltration of credentials, logs, screenshots, active-window data, and other victim information.
The loader component uses staged decryption and in-memory execution, including shellcode-based unpacking and browser-focused code injection. It employs anti-debugging and anti-VM checks and may stall indefinitely when it detects analysis environments. Persistence has been achieved through Windows service creation and abuse of policy-related mechanisms. Gootkit has also been associated with browser-process injection and broader defense-evasion tradecraft.
Distribution has evolved over time. Early campaigns used spam and exploit kits, while later activity relied heavily on compromised websites, fake forum pages, and SEO poisoning to lure victims into downloading JavaScript-based loaders. GootLoader has been widely described as the initial-access framework used to deliver Gootkit and other follow-on payloads, making Gootkit part of a broader criminal delivery ecosystem. Campaigns linked to GootLoader and related infrastructure have targeted business users and sectors including legal, government, finance, healthcare, automotive, pharmaceutical, energy, and other enterprises, with significant victimization reported in Europe and North America.
Gootkit has also appeared in multi-malware operations and has been delivered by or alongside other criminal services and malware families. It has been referenced as a downstream payload in campaigns involving loaders and botnets such as Emotet, and it has been associated with financially motivated cybercrime activity targeting banking customers and enterprise environments. Its long-running use, modular design, and integration with web-injection and credential-theft workflows make it a significant banking-trojan family in the Windows threat landscape.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
We have observed final payloads including Ramnit, Gootkit, DarkVNC, Ursnif, and PsiXBot.
Delivered malware included ZLoader (a.k.a. Terdot), Gootkit, Ursnif, Corebot, Panda Banker, Atmos, Mazar Bot, and Red Alert Android malware.
Storm-0324 has distributed a range of first-stage payloads since at least 2016, including: ... Gootkit, a banking trojan
29 distinct techniques documented for this family, organized by ATT&CK tactic.
GootLoader is an initial access malware... It is delivered through drive-by social engineering attacks.
Initially it was distributed via spam and exploits kits such as Spelevo and RIG.
The emails include ZIP attachments, pre-downloaded from the attacker’s server, containing a decoy PDF file and a malicious VBS file.
The emails are crafted in the targeted country’s language and are often personalized to include recipients’ names and addresses in various parts of the email such as email body and subject. TA554 frequently uses package delivery or order notification lures; the emails contain URLs linking to zipped LNK files or zipped documents.
The Gootkit Banking Trojan was discovered back in 2014, and utilizes the Node.JS library to perform a range of malicious tasks.
Executing the VBS file leads to downloading further malware using a PowerShell command.
The emails include ZIP attachments... containing a decoy PDF file and a malicious VBS file. Executing the VBS file leads to downloading further malware using a PowerShell command.
the loader tries to find registry keys with the following format: HKCU\Software\AppDataLow\<pr_string>_<i> ... Each key contains a maximum chunk of 512,000 bytes (500KB) of encrypted data. | So Gootkit creates an .inf file in the same directory as the sample and writes the following values to the Software\Microsoft\IEAK\GroupPolicy\PendingGPOs registry key
If the sample is running under another account, it creates a service with a random name chosen from %SystemRoot%, copies itself into the %SystemRoot% folder with the chosen name and deletes itself from the disk.
iterates over the running processes and tries to inject the decrypted DLLs into the process memory of the designated process using the NtCreateSection/NtMapViewOfSection API.
The loader is composed of three highly obfuscated layers that contain encoded URLs.
iterates over the running processes and tries to inject the decrypted DLLs into the process memory of the designated process using the NtCreateSection/NtMapViewOfSection API.
Note that each “while” loop is performing string decryption on the sequences of bytes shown in the variables above the loop. When following the execution in a debugger, the strings are decrypted, and some meaningful indicators of VM checks are visible.
the Gootkit loader employs lots of different methods to detect virtual environments or debuggers. If any of the virtual machine checks succeed, the loader enters an infinite loop.
The rest of the checks include: Compare user name to "CurrentUser"/"Sandbox" Compare computer name to "SANDBOX"/"7SILVIA" HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion" compare with AMI, VirtualBox, BOCHS, INTEL 640000, 55274-640-2673064-23950, and other serials
the loader tries to find registry keys with the following format: HKCU\Software\AppDataLow\<pr_string>_<i> ... Each key contains a maximum chunk of 512,000 bytes (500KB) of encrypted data. | So Gootkit creates an .inf file in the same directory as the sample and writes the following values to the Software\Microsoft\IEAK\GroupPolicy\PendingGPOs registry key
Continuing on, Gootkit will query HARDWARE\DESCRIPTION\System\SystemBiosVersion and compare the value to; AMI, BOCHS, VBOX, QEMU... Yet another registry query is performed, this time with the key HARDWARE\Description\System\VideoBiosVersion.
the Gootkit loader employs lots of different methods to detect virtual environments or debuggers. If any of the virtual machine checks succeed, the loader enters an infinite loop.
The rest of the checks include: Compare user name to "CurrentUser"/"Sandbox" Compare computer name to "SANDBOX"/"7SILVIA" HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion" compare with AMI, VirtualBox, BOCHS, INTEL 640000, 55274-640-2673064-23950, and other serials
Gootkit is capable of stealing data from the browser, performing man-in-the-browser attacks, keylogging, taking screenshots
Indicators of Compromise ... jonathanbartz[.]com Command and Control
Gootloader, which attempts to retrieve the final payload, whether it be ransomware, a banking trojan or intrusion tool/credential stealer.
Recently, we came across web malware that – instead of injecting an iframe pointing to a fixed existing address – generates a pseudo-random domain name, depending on the current date. This approach is not new and is widely used by botnets in C&C domain name generation.
112 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
57 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Gootkit is a banking trojan first reported in 2014 that uses Node.js components and supports persistence, C2-based loader updates, browser DLL injection, credential theft, web injections, video recording, and remote VNC-style access. In this sample it establishes persistence via either a created Windows service or an IEAK PendingGPO INF-based mechanism, disables Internet Explorer Protected Mode across zones, scans for browsers, and injects x86/x64 DLLs into targeted browser processes.
The State of SSL/TLS Certificate Usage in Malware C&C Communications AdWind ostap AsyncRAT BazarBackdoor BitRAT Buer Chthonic CloudEyE Cobalt Strike DCRat Dridex FindPOS GootKit Gozi IcedID ISFB Nanocore RAT Orcus RAT PandaBanker Qadars QakBot Quasar RAT Rockloader ServHelper Shifu SManager TorrentLocker TrickBot Vawtrak Zeus Zloader
Referenced as a possible secondary payload retrieved by JavaScript-based initial access malware.
Secondary payload referenced as being delivered by GootLoader; also referenced as the group frequently associated with GootLoader operations.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.