Loading malware…
Godzilla Loader is a Windows malware loader and downloader marketed in cybercrime forums and used to deliver follow-on payloads including banking malware. It has been observed as an intermediary stage in the distribution of TrickBot and other banking malware families, where an initial executable installs the loader and the loader then retrieves the actual payload from remote command-and-control infrastructure. It has also been positioned commercially as a lower-cost competitor to more established criminal loaders.
The malware is notable for extensive use of COM-based execution and communication logic. Reported implementations use browser-related COM interfaces for command-and-control interaction and HTML parsing, persistence-related COM interfaces for maintaining access, and shell-related COM interfaces to launch local programs. This design has been assessed as potentially reducing visibility in some behavioral sandbox environments. Godzilla Loader also includes a built-in UAC bypass based on the eventvwr.exe registry hijack technique, enabling elevated execution without requiring prior administrator privileges.
Additional functionality attributed to Godzilla Loader includes verification of command-and-control responses using RSA-2048 signatures, which helps prevent unauthorized takeover of infected clients if infrastructure changes hands. It also implements fallback command-and-control discovery mechanisms, first through a domain generation algorithm and then through social-media-based discovery using pseudo-random daily hashtags. Reported versions also include destructive system actions such as deletion of shadow copies, a capability relevant to ransomware enablement, and planned plugin support for propagation, keylogging, and password theft.
Observed delivery has included malicious spam carrying a disguised executable attachment that installs the loader, after which Godzilla Loader downloads and executes the next-stage malware. Early reporting characterized its infection volume as relatively limited compared with larger loader ecosystems, but its feature set and active development made it a notable component of the broader cybercrime malware market.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
In later versions, the author boasts that they have converted even more of the control flow to rely entirely on COM interfaces; persistence is achieved via the IPresistFile interface...
As alluded to in the ad, Godzilla loader comes with a built-in UAC bypass — to be specific, the one described here. This UAC bypass relies on a behavioral quirk in the privileged process eventvwr.exe; when consulting the registry for the location of the Microsoft Management Console, it consults a key which can be modified with no privilege requirements. An attacker can therefore specify whichever executable they please, and this executable will run with administrator privileges.
First, if communication with the server is not successful, the malware defaults to its DGA implementation; then, if that’s not successful, either, it checks Twitter for a specific hashtag... The campaign controller can announce new C&C sites by generating the hashtag themselves and tweeting the new C&C domain with this hashtag.
The login panel for the Command & Control (C2) server appears at the URL admin.php ... TrickBot uses the following path template ... The response from the C2 server will look similar to ...
Godzilla fills the “downloader” or “dropper” niche, offering a level of indirection such that the binary that first runs on the victim machine does not contain any of the actual payload, and instead downloads the payload from a remote server.
First, if communication with the server is not successful, the malware defaults to its DGA implementation; then, if that’s not successful, either, it checks Twitter for a specific hashtag (which is pseudo-randomly generated depending on the day, similarly to the DGA).
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Loader malware used as an intermediary to install and distribute TrickBot via spam-delivered malicious attachments.
Mentioned as a comparative example of malware marketing and feature competition.
A malware loader/downloader advertised on dark web forums that retrieves payloads from a remote C2 rather than embedding them in the initial binary. The article describes built-in UAC bypass, heavy use of COM objects for C2 communication and execution flow, RSA-2048 verification of C2 responses, fallback DGA and Twitter-based C2 recovery, shadow copy deletion, and planned plugin modules for propagation, keylogging, and password theft.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.