GootLoader Malware: Evolving Tactics in ZIP Archive Delivery

GootLoader, a malware loader frequently utilized in ransomware attacks, has recently adopted a sophisticated method of evading detection through the use of intentionally malformed ZIP archives. According to a report by Expel, these ZIP files are constructed by concatenating between 500 to 1,000 individual ZIP archives, creating a unique file for each victim. This design not only complicates automated analysis but also ensures that the malicious JScript payload can be executed by the default Windows unarchiving tool, while failing to be processed by popular forensic tools like WinRAR and 7-Zip.

Gootloader malware now uses “ZIP bomb” tactic to evade detectionGootLoader Malware Uses 500–1,000 Concatenated ZIP Archives to Evade DetectionHow Gootloader uses malformed ZIP archives to evade detection

The ZIP archives employed by GootLoader exhibit several anomalies that hinder detection efforts. Notably, the End of Central Directory (EOCD) section is truncated, omitting critical bytes that lead to parsing errors in many unarchiving tools. Additionally, metadata inconsistencies, such as mismatched values between the Local File Header and the Central Directory, further complicate extraction attempts. These tactics, collectively referred to as "hashbusting," ensure that each ZIP file is unique and resistant to hash-based detection methods.

How Gootloader uses malformed ZIP archives to evade detectionGootLoader Malware Uses 500–1,000 Concatenated ZIP Archives to Evade DetectionGootloader malware now uses “ZIP bomb” tactic to evade detection

Once the JScript file is executed, it initiates a multi-stage infection process. The malware creates a Windows shortcut (.LNK) in the Startup folder, which points to another .LNK file located in a randomly chosen directory. This secondary shortcut executes another JScript file, which in turn launches PowerShell scripts to facilitate further payload delivery and establish persistence. The use of NTFS short names and obfuscated commands complicates tracking and detection of these processes.

Gootloader malware now uses “ZIP bomb” tactic to evade detectionHow Gootloader uses malformed ZIP archives to evade detectionGootLoader Malware Uses 500–1,000 Concatenated ZIP Archives to Evade Detection

To counter the threat posed by GootLoader, organizations are advised to implement several security measures. These include blocking the execution of "wscript.exe" and "cscript.exe" for downloaded content unless necessary, and configuring Group Policy Objects (GPO) to set Notepad as the default program for opening JScript files. Additionally, monitoring for the creation of .LNK files in the Startup folder that point to non-standard directories can help identify potential GootLoader infections.

How Gootloader uses malformed ZIP archives to evade detectionGootLoader Malware Uses 500–1,000 Concatenated ZIP Archives to Evade DetectionGootloader malware now uses “ZIP bomb” tactic to evade detection

Despite GootLoader's advanced obfuscation techniques, Expel has developed a YARA rule that can detect these malicious ZIP archives by identifying specific patterns, such as multiple occurrences of the same Local File Header and malformed EOCD structures. This detection capability is crucial for organizations aiming to defend against the evolving tactics of GootLoader.

Gootloader malware now uses “ZIP bomb” tactic to evade detection

GootLoader's recent evolution in delivery methods highlights the ongoing challenges in cybersecurity, particularly in the realm of malware detection and prevention. By employing complex techniques to evade traditional analysis workflows, GootLoader continues to pose a significant threat to organizations. As the malware landscape evolves, so too must the strategies employed by defenders to safeguard against these sophisticated attacks.

GootLoader Malware Uses 500–1,000 Concatenated ZIP Archives to Evade Detection