{"id":70310,"date":"2022-09-30T15:58:32","date_gmt":"2022-09-30T14:58:32","guid":{"rendered":"https:\/\/www.n-able.com\/?p=70310"},"modified":"2025-08-28T10:38:28","modified_gmt":"2025-08-28T09:38:28","slug":"everything-you-need-to-know-about-tracking-gootloader","status":"publish","type":"post","link":"https:\/\/www.n-able.com\/it\/blog\/everything-you-need-to-know-about-tracking-gootloader","title":{"rendered":"Everything you Need to Know about Tracking GootLoader"},"content":{"rendered":"

The Adlumin Threat Visibility Team has observed an increase in GootLoader-based malware and identified a possible unified campaign leveraging GootLoader with follow-on Cobalt Strike payloads in attempts to breach U.S. businesses including multiple customers.<\/p>\n

What is GootLoader?<\/h2>\n

GootLoader is a presumed access-as-a-service malware\u00a0<\/span>1<\/sup>, with its developers also being responsible for the GootKit malware as first reported by Dr. Web in 2014\u00a0<\/span>2<\/sup>. GootKit, the actor\u2019s namesake and original toolkit, is distinct from GootLoader in that GootLoader is closer to an initial access capability which leverages follow on stages such as Cobalt Strike, various Ransomware payloads, and potentially GootKit \u2013 the latter of which has fallen out of favor since gaining notoriety in 2019 due to infrastructure compromise\u00a0<\/span>3<\/sup>.
\nAs an access-as-a-service malware, the GootLoader operators would be expected to sell direct access to compromised hosts and systems or provide buyers with harvested credentials and access points into a targeted network. A less frequent operation under this model might involve the GootLoader actors loading second-stage payloads as access brokers.<\/p>\n

Tracking the Campaign<\/h2>\n

We are observing and tracking an active exploitation campaign utilizing GootLoader against U.S. businesses in multiple industries and verticals. What we\u2019ve observed in this campaign is uniform deployment of Cobalt Strike payloads following exploitation and initial access provided by GootLoader. It\u2019s unknown if these Cobalt Strike payloads are used by GootLoader developers to provide direct access to an infected target or used to harvest credentials and other data which is brokered to a buyer for access or exploited in some other way.
\nOur investigation is tracking an exploitation campaign which we defined based on:<\/strong><\/p>\n

    \n
  1. Like to identical initial access and exploit methodologies<\/li>\n
  2. Like to identical command and control infrastructure and methodology<\/li>\n
  3. Like to identical operations time-frame<\/li>\n
  4. Like to identical first-stage \u201cloader\u201d malware, GootLoader<\/li>\n
  5. Like to identical second-stage follow-on malware, Cobalt Strike<\/li>\n<\/ol>\n

    Campaign Tactics, Techniques, and Procedures (TTPs)<\/h2>\n

    This GootLoader campaign begins its attack by phishing potential victims\u2019 business emails. Unlike other campaigns reported earlier in 2021 and 20224<\/sup>, this campaign has not yet been observed relying on specific SEO poisoning attacks to deliver its payload. We believe the payloads are also not being disguised as legitimate JQuery libraries as previously seen.
    \nIt starts with an email\u2026
    \n\"\"<\/p>\n

    Figure 1: The Attack Begins with a Malicious JavaScript file contained in a Zip Archive<\/em><\/p>\n

    The first stage in the campaign against a target is a simple phishing email. These emails have an attached Zip archive, which contains a JavaScript payload the victim is tricked in to running after opening. This JavaScript payload is executed by a Windows Operating System native binary, Windows Script Host (wscript.exe), which is a legitimate application typically used for logon scripts, administration, and automation and provides an execution environment in which the script can run. Our team believes that the JavaScript payload is delivered via a compressed archive to help mitigate detection by email and malware scanners.<\/p>\n

    \"GootLoader_Image_2\"<\/p>\n

    Figure 2: JavaScript is executed by wscript.exe<\/em><\/p>\n

    GootLoader will then use this wscript.exe executing JavaScript to download an additional\u00a0 JavaScript resource which is loaded by the original calling wscript.exe process. This secondary exploitation payload is responsible for persisting two separate payloads.<\/p>\n

    \"GootLoader_Image_3\"<\/p>\n

    Figure 3: wscript.exe retrieves payloads from Command and Control Server<\/em><\/p>\n

    Persistence<\/h2>\n

    GootLoader will use its secondary JavaScript payload to write two registry keys to the Window\u2019s Current User registry hive (HKCU). In this tracked campaign the two registry keys were stored in:<\/p>\n