GootLoader Malware Uses 500–1,000 Concatenated ZIP Archives to Evade Detection

Key Points:

• GootLoader malware utilizes a unique method of concatenating 500–1,000 malformed ZIP archives to evade detection by traditional unarchiving tools, while still being extractable by the default Windows unarchiver.
• The impact includes potential delivery of secondary payloads such as ransomware, with the malware exploiting social engineering tactics and compromised WordPress sites to target users seeking legal templates.
• Recommended actions include blocking "wscript.exe" and "cscript.exe" from executing downloaded content and configuring Group Policy Objects (GPO) to open JavaScript files in Notepad by default.

Technical Details: GootLoader employs a defense-evasion technique known as "hashbusting," creating unique ZIP files for each user to hinder detection efforts. The attack chain involves delivering XOR-encoded blobs that are decoded client-side, leading to the execution of JavaScript payloads via Windows' default tools.

MITRE ATT&CK Techniques:

• T1203 - Exploit Public-Facing Application (Initial Access)
• T1059.001 - Command and Scripting Interpreter: Windows Script Host (Execution)
• T1547.001 - Boot or Logon Autostart Execution: Startup Folder (Persistence)
• T1027.002 - Obfuscated Files or Information: Software Packing (Defense Evasion)

IOCs Mentioned: None mentioned