# After 7 months of lying dormant, Gootloader resurfaces with a tactic that confuses antivirus software.

## **Overview**

Recently, a dangerous attack campaign has resurfaced, known as **Gootloader.** It is a "loader" (malicious code loader) written in JavaScript, commonly used to create an "initial access" point for attackers.

First, let's go over a few details about **Gootloader.** It is designed to **infect the victim's computer, download, and execute other payloads.** These are usually **ransomware, backdoors, or remote access tools (RATs).** **Gootloader** first appeared around **2020** as a development branch of **Gootkit Trojan**—a type of banking trojan specialized in stealing financial information. Over time, Gootloader has **evolved** from a single trojan into a **versatile malware distribution platform** used or shared by many cybercriminal groups.

![Gootloader's “mothership” controls malicious content – Sophos News](https://news.sophos.com/wp-content/uploads/2021/03/gootloader-party-wall.png align="center")

Each **Gootloader** campaign is often associated with **SEO poisoning campaigns**—exploiting search engines to trick users into downloading malicious files. They frequently target **small and medium-sized businesses**, especially **administrative, accounting, and law firms, or individual users** who habitually download free documents from Google.

Once a system is infected with Gootloader, **attackers can gain control of the network's Domain Controller** within a few hours. Recorded attacks have shown that internal scanning activity can begin in just **20 minutes**. This is why it is considered **one of the most dangerous and sophisticated loaders today**, as it not only infects but also **deceives both users and automated defense systems.**

![GootLoader, From SEO Poisoning to Multi-Stage Downloader](https://blogs.blackberry.com/content/dam/blogs-blackberry-com/images/blogs/2022/07/gootloader-fig10.png align="center")

## **Campaign Details**

![](https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F709e79b4c5444cd38b8297c7053da8e5 align="center")

As mentioned, to carry out the initial campaign, the attacker will trick the victim into visiting a compromised website (SEO poisoning) and then click on a fake download link to download the payload.

![](https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F9d1053e339144907a5bc649b005293c1 align="center")

An interesting point here is that **Gootloader** uses regular endpoints like WordPress's `/wp-comments-post.php` to receive POST requests and distribute the payload. This makes it easy to deceive victims and difficult to detect, helping it evade monitoring systems.

![](https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F90c3540d9fba45a58a82d00c992e5f04 align="left")

The payload ZIP will be XOR encrypted by the attacker with a private key based on the file name, as recorded in this campaign: `Missouri_Utility_Easement_Guide_2023.pdf`.

![](https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F0314ad938c704182ad02144f267aa045 align="left")

Another point to note about this malware is its "stealth" technique using "**WOFF2 font" and "glyph substitution."** This is a sophisticated technique in JavaScript source code. Here, the file name or character appears normal when users view the page, but in reality, the source code contains "junk" characters like `›μI€vSO₽*'Oaμ==€‚‚33O%33‚€×:O[TM€v3cwv,.`. This means the **WOFF2 Font** will be embedded in **JavaScript (Z85 encoding),** and when the browser renders, the glyphs of characters like "O," "a," "9," "±" are swapped to display different characters.

**\=> For example: "9" displays as "o," "±" as "i."**

![](https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Fcee68841f8094a4d93727bedec7e1306 align="center")

Once the victim downloads it, **Gootloader** will continue to maintain itself on the target machine using a **Scheduled Task**. At this stage, it will create a `.lnk` shortcut file in `%AppData%\Roaming\ISIS Drivers\Outreach Services.lnk` and `%AppData%\Roaming\PFU\Molecular Ecology.lnk`... using long names but referencing them with **8.3 (short filename).** We can simply understand **8.3 (short filename)** as the **old file name format** from DOS: up to 8 characters for the name, 3 characters for the extension. The main purpose is still to hide the long name, deceive signatures, and avoid detection based on strings.

\=> for example `REPORT.TXT`

![MS-DOS DIR /X Command - Display short names for non-8dot3 file names](https://i.ytimg.com/vi/uGFYiJTjMVM/maxresdefault.jpg align="center")

Then the shortcut will launch the `.js` file (for example, `EMC ControlCenter.js`, `Adaptive Algorithms.js`) located in the same folder.

![](https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2F24fab952d4e04b9e84e432d39e8f017f align="center")

Once the loader is active, the backdoor will naturally execute, typically deploying the Supper backdoor. The technique of the Supper backdoor is very "sophisticated," although its function is not new:

* **API hammering (calling multiple APIs to disrupt analysis).**
    
* **Building shellcode at runtime: writing bytecode into memory, marking the memory as executable, and jumping into it.**
    
* **Using API hashing to avoid hooking and common security tools: using** `LdrGetDllHandle` **and** `LdrLoadDll` **instead of** `LoadLibraryA`.\*\*
    
* **Data sent and received to C2 is encrypted using an XOR cipher.**
    

![](https://cdn.builder.io/api/v1/image/assets%2F3eb6f92aedf74f109c7b4b0897ec39a8%2Fabfb441e7ba847f08b7a4ef0b1a3b011 align="left")

Finally, after the backdoor is deployed, a series of common actions will be carried out, such as listing domain controller servers, scanning Domain Admins groups, and performing Kerberoasting (a technique to extract service passwords from Active Directory):

* **net user <username> /domain**
    
* **nltest /dclist:**
    
* **net group "domain admins" /domain**
    
* **nltest /domain\_trusts**
    
* **cmd.exe /Q /c echo C:\\Windows\\system32\\cmd.exe /C vssadmin list shadows /for=C: ^> C:\\Windows\\Temp\\\_\_output > C:\\Windows\\TEMP\\execute.bat & C:\\Windows\\system32\\cmd.exe /Q /c C:\\Windows\\TEMP\\execute.bat & del C:\\Windows\\TEMP\\execute.bat**
    

In the campaign, it took less than 17 hours from the initial breach to taking over the Domain Controller and creating a user in Domain Admins, demonstrating the dangerous level of this malware. Additionally, they also performed **lateral movement** through **WinRM**, using tools like Impacket to execute remote commands. After that, they likely dumped the AD database (NTDS.dit) and enumerated Volume Shadow Copies (to prepare for ransomware).

And of course, throughout the entire process, the information they obtained was sent to C2 servers to maintain the connection.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1762531584108/f8605c29-c582-45a6-8c4d-f8ed2f9caf63.png align="center")

## **Conclusion**

Although **Gootloader** uses **very advanced** techniques (WOFF2 font to hide file names, XOR encryption, JavaScript obfuscation), the **post-intrusion attack model** relies on "basic but effective" techniques like AD enumeration, lateral movement, and creating Domain Admin accounts.

This highlights an important message: **there's no need for zero-day exploits for the entire attack chain**. The attacker only needs an entry point ("loader") and then uses known techniques to control the environment.

## **Recommendations**

1. **Isolate suspicious hosts**
    
    * As soon as you detect a host with a strange `.lnk` file or a process running from `%AppData%`/Startup, isolate the host from the network (disconnect network / remove VLAN).
        
2. **Limit permissions**
    
    * Minimize permissions to run PowerShell, restrict users with local admin rights, and enable full logging for WinRM, PowerShell, and Event Logs.
        
3. **Only download documents from official or trusted sources.**
    
    * If you need a "rental agreement template," download it from a government website or a reputable company, **do not download from blogs, forums, or sites with strange ads**.
        
4. **Be cautious of "SEO poisoning" search results**
    
    * Attackers create fake websites that appear at the top of Google with legitimate titles (PDF, DOC, Guide...), but when you click to download, you receive a `.zip` containing `.js` or `.lnk`.
        
5. **When receiving emails or messages with attachments**
    
    * **Do not open attachments from strangers, or when the email simply says "please see the document" without specific content.**
        
    * **Check the real file extension carefully:**
        
        * In Windows, enable "File name extensions" (View → tick "File name extensions") to see if it's really `.pdf` or `.js`.
            
        * Attackers often name files like "`Invoice.pdf.js`" to trick users.
            
    * **Do not click on shortcuts (.lnk)** even if the icon looks like Word/PDF.
        

## **IOC**

1. **C2**
    
    * 103.253.42\[.\]91
        
    * 91.236.230\[.\]134
        
    * 213.232.236\[.\]138
        
    * 146.19.49\[.\]177
        
    * **178.32.224\[.\]219**
        
    * **37.59.205\[.\]2**
        
    * **193.104.58\[.\]64**
        
2. **File Hash**
    
    * cf44aa11a17b3dad61cae715f4ea27c0cbf80732a1a7a1c530a5c9d3d183482a
        
    * 39d980851be1e111c035e4db2589fa3d5f59a5bef7b7b3e36bff5435c78f7049
        
    * b9a61652dffd2ab3ec3b7e95829759fc43665c27e9642d4b2d4d2f7287254034
        
    * 2f056ce0657542da3e7e43fb815a8973c354624043f19ef134dff271db1741b3
        
    * c2326db8acae0cf9c5fc734e01d6f6c1cd78473b27044955c5761ec7fd479964
        
    * ad88076fd75d80e963d07f03d7ae35d4e55bd49634baf92743eece19ec901e94
        
    * cf44aa11a17b3dad61cae715f4ea27c0cbf80732a1a7a1c530a5c9d3d183482a
        
    * c2b9782c55f75bb1797cb4fbae0290b44d0fcad51bf4f2c11c52ebbe3526d2ac
        
    * 7557d5fed880ee1e292aba464ffdc12021f9acbe0ee3a2313519ecd7f94ec5c4
        
    * 5ec9e926d4fb4237cf297d0d920cf0e9a5409f0226ee555bd8c89b97a659f4b0
        
    * 87cbe9a5e9da0dba04dbd8046b90dbd8ee531e99fd6b351eae1ae5df5aa67439
        
3. **Domain**
    
    * hxxps://[cortinaspraga.com/](http://cortinaspraga.com/)
        
    * hxxp://[cookcountyjudges.org/](http://cookcountyjudges.org/)
        
    * hxxps://[x.fybw.org/](http://x.fybw.org/)
        
    * hxxps://[jungutah.com/](http://jungutah.com/)
        
    * hxxps://[influenceimmo.com/](http://influenceimmo.com/)
        
    * hxxps://[tokyocheapo.com/](http://tokyocheapo.com/)
        
    * hxxps://[espressonisten.de/](http://espressonisten.de/)
        
    * hxxps://[tiresdoc.com/](http://tiresdoc.com/)
        
    * hxxps://[hotporntv.net/](http://hotporntv.net/)
        
    * hxxps://[yourboxspring.nl/](http://yourboxspring.nl/)
        
    * **hxxps://**[**filmcrewnepal.com/**](http://filmcrewnepal.com/)
        
    * **hxxps://**[**yoga-penzberg.de/**](http://yoga-penzberg.de/)
        
    * **hxxps://**[**sugarbeecrafts.com/**](http://sugarbeecrafts.com/)
        
    * **hxxps://**[**www.worldwealthbuilders.com/**](http://www.worldwealthbuilders.com/)
        
    * **hxxps://**[**lepolice.com/**](http://lepolice.com/)
        
    * **hxxps://**[**www.lovestu.com/**](http://www.lovestu.com/)
        
    * **hxxps://**[**bluehamham.com/**](http://bluehamham.com/)
        
    * **hxxps://**[**vps3nter.ir/**](http://vps3nter.ir/)
        
    * **hxxps://**[**whiskymuseum.at/**](http://whiskymuseum.at/)
        
    * **hxxps://**[**latimp.eu/**](http://latimp.eu/)
        
    * **hxxps://**[**solidegypt.net/**](http://solidegypt.net/)
        
    * **hxxps://**[**wessper.com/**](http://wessper.com/)
        
    * **hxxps://**[**www.pathfindertravels.se/tickets/**](http://www.pathfindertravels.se/tickets/)
        
    * **hxxps://**[**www.smithcoinc.biz/**](http://www.smithcoinc.biz/)
        
    * **hxxps://**[**kollabmi.se/**](http://kollabmi.se/)
        
    * **hxxps://**[**xxxmorritas.com/**](http://xxxmorritas.com/)
        
    * **hxxps://**[**onsk.dk/**](http://onsk.dk/)
        
    * **hxxps://**[**villasaze.ir/**](http://villasaze.ir/)
        
    * **hxxps://**[**blossomthemesdemo.com/**](http://blossomthemesdemo.com/)
        
    * **hxxps://**[**headedforspace.com/**](http://headedforspace.com/)
        
    * **hxxps://**[**spirits-station.fr/**](http://spirits-station.fr/)
        
    * **hxxps://**[**www.us.registration.fcaministers.com/**](http://www.us.registration.fcaministers.com/)
        
    * **hxxps://**[**motoz.com.au/**](http://motoz.com.au/)
        
    * **hxxps://**[**routinelynomadic.com/**](http://routinelynomadic.com/)
        
    * **hxxps://**[**www.wagenbaugrabs.ch/**](http://www.wagenbaugrabs.ch/)
        
    * **hxxps://**[**studentspoint.org/**](http://studentspoint.org/)
        
    * **hxxps://**[**cortinaspraga.com/**](http://cortinaspraga.com/)
        
    * **hxxps://**[**dailykhabrain.com.pk/**](http://dailykhabrain.com.pk/)
        
    * **hxxps://**[**myanimals.com/**](http://myanimals.com/)
        
    * **hxxps://**[**www2.pelisyseries.net/**](http://www2.pelisyseries.net/)
        
    * **hxxps://**[**www.claritycontentservices.com/wp/**](http://www.claritycontentservices.com/wp/)
        
    * **hxxps://**[**patriotillumination.com/**](http://patriotillumination.com/)
        
    * **hxxps://**[**michaelcheney.com/**](http://michaelcheney.com/)
        
    * **hxxps://**[**allreleases.ru/**](http://allreleases.ru/)
        
    * **hxxps://**[**cloudy.pk/**](http://cloudy.pk/)
        
    * **hxxps://**[**eliskavaea.cz/**](http://eliskavaea.cz/)
        
    * **hxxps://**[**r34porn.net/**](http://r34porn.net/)
        
    * **hxxps://**[**www.wagenbaugrabs.ch/**](http://www.wagenbaugrabs.ch/)
        
    * **hxxps://**[**leadoo.com/**](http://leadoo.com/)
        
    * **hxxps://**[**ostmarketing.com/**](http://ostmarketing.com/)
        
    * **hxxps://**[**egyptelite.com/**](http://egyptelite.com/)
        
    * **hxxps://**[**restaurantchezhenri.ca/**](http://restaurantchezhenri.ca/)
        
    * **hxxps://**[**www1.zonewebmaster.eu/news/**](http://www1.zonewebmaster.eu/news/)
        
    * **hxxps://**[**campfosterymca.com/**](http://campfosterymca.com/)
        
    * **hxxps://**[**idmpakistan.pk/**](http://idmpakistan.pk/)
        
    * **hxxps://**[**themasterscraft.com/**](http://themasterscraft.com/)
        
    * **hxxps://**[**unica.md/**](http://unica.md/)
        
    * **hxxps://**[**cargoboard.de/**](http://cargoboard.de/)
        
    * **hxxps://**[**www.supremesovietoflove.com/wp/**](http://www.supremesovietoflove.com/wp/)
        
    * **hxxps://**[**buildacampervan.com/**](http://buildacampervan.com/)
        
    * **hxxps://**[**www.minklinkaps.com/**](http://www.minklinkaps.com/)
        
    * **hxxps://**[**aradax.ir/**](http://aradax.ir/)
        
    * **hxxps://**[**medicit-y.ch/**](http://medicit-y.ch/)
        
    * **hxxps://**[**redronic.com/**](http://redronic.com/)
        
    * **hxxps://**[**www.ferienhausdehaanmieten.de/**](http://www.ferienhausdehaanmieten.de/)
        
    * **hxxps://**[**gravityforms.ir/**](http://gravityforms.ir/)
        
    * **hxxps://**[**apprater.net/**](http://apprater.net/)
        
    * **hxxps://**[**fotbalovavidea.cz/**](http://fotbalovavidea.cz/)
        
    * **hxxps://**[**usma.ru/**](http://usma.ru/)
        
    * **hxxps://**[**thetripschool.com/**](http://thetripschool.com/)
        

## **Reference**

1. [Gootloader malware is back with new tricks after 7-month break](https://www.bleepingcomputer.com/news/security/gootloader-malware-is-back-with-new-tricks-after-7-month-break/)
    
2. [Gootloader | Threat Detection Overview | Huntress](https://www.huntress.com/blog/gootloader-threat-detection-woff2-obfuscation)