GootLoaderMalware
- slowpour
According to PCrisk, they discovered GootLoader malware while examining legitimate but compromised websites (mainly websites managed using WordPress). It was found that GootLoader is used to infect computers with additional malware. Cybercriminals using GootLoader seek to trick users into unknowingly downloading and executing the malware by disguising it as a document or other file.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io5 reports
ATT&CK techniques
6 of 10 · each with the sentence it comes from- T1053.005Scheduled Task
“Uncommon scheduled tasks”
- T1003.003NTDS
“Following persistence establishment, the threat actor used ntdsutil to dump the NTDS.dit database (T1003.003), then compressed it into a ZIP archive, likely staged for exfiltration.”
- T1003.006DCSync
“Subsequently, the threat actor leveraged their existing Domain Admin privileges to perform a DCSync attack.”
- T1021.001Remote Desktop Protocol
“📡 Modified the Windows firewall to allow more remote desktop protocol (RDP) traffic”
- T1021.006Windows Remote Management
“…and 54 minutes after the initial JavaScript execution and reconnaissance activity, the threat actor moved laterally via WinRM (Windows Remote Management) to the Domain Controller.”
- T1027.007Dynamic API Resolution
“Besides, the first stage employs common techniques such API hammering and dynamic API resolution.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
OysterLoader Unmasked: The Multi-Stage Evasion Loader“According to Huntress, OysterLoader is also distributed via Gootloader.”
-
Active Ivanti Exploitation Traced to Single Bulletproof IP—Published IOC Lists Point Elsewhere“That network has been associated with distribution infrastructure for GootLoader, SpyNote, and other malware families.”
-
Gootloader | Threat Detection Overview“Gootloader | Threat Detection Overview”
-
Detect and Eliminate Persistent Malware Before It Wreaks Havoc“A manufacturer found that out when an employee downloaded Gootloader malware via an SEO poisoning attack.”
-
Bringing the Hunt to Australia and New Zealand“Matthew’s research on how to use Ghidra for understanding Gootloader, for example, has helped our global ThreatOps team make quick work of this malware when they come across it.”
Indicators in its reports
named in the reports above- pefile[.]pein 1 report
- exp[.]namein 1 report
- 85.239.53[.]66in 1 report
- 51.222.96[.]108in 1 report
- 135.125.241[.]45in 1 report
- hxxps://grandideapay[.]com/api/v2/facadein 1 report
- grandideapay[.]comin 1 report
- hxxp://nucleusgate[.]com/api/v2/facadein 1 report
- nucleusgate[.]comin 1 report
- hxxps://cardlowestgroup[.]com/api/v2/facadein 1 report
- cardlowestgroup[.]comin 1 report
- hxxps://socialcloudguru[.]com/api/v2/facadein 1 report
- socialcloudguru[.]comin 1 report
- hxxps://coretether[.]com/api/v2/facadein 1 report
- coretether[.]comin 1 report
- hxxps://registrywave[.]com/api/v2/facadein 1 report
- registrywave[.]comin 1 report
- cf44aa11a17b3dad…c9d3d183482ain 1 report
- 103.253.42[.]91in 1 report
- 91.236.230[.]134in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.