Loading malware…
Gootkit is a Windows banking malware family first identified in 2014 that evolved into a modular infostealer and malware delivery platform. It is notable for combining a native loader with a JavaScript-based main body executed through an embedded Node.js runtime, and for extensive anti-analysis, anti-debugging, and anti-virtualization logic. Historically associated with banking fraud, Gootkit later expanded to broader credential theft, browser surveillance, traffic manipulation, and follow-on payload delivery.
Core capabilities attributed to Gootkit include theft of browser data and authentication material, keylogging, screenshot capture, cookie collection, form grabbing, and man-in-the-browser style web injection. Browser-focused components are injected into major browsers to manipulate traffic and facilitate fraudulent activity, including bypassing certificate validation to enable interception and modification of web sessions. Analyses have also documented support for remote surveillance features such as video recording and VNC-style remote access in some variants.
The malware commonly uses multi-stage loaders, custom packing, runtime string decryption, shellcode-based unpacking, and in-memory execution. It has been observed establishing persistence through Windows services, scheduled tasks, and other Windows-native mechanisms, while using process injection and DLL injection to evade detection and operate inside legitimate processes. Gootkit is also known for aggressive sandbox and VM detection, including checks of usernames, computer names, BIOS artifacts, processor characteristics, MAC-derived identifiers, and debugging-related modules; when triggered, these checks can cause the malware to terminate, delete itself, or enter indefinite sleep loops.
Distribution has changed over time. Early campaigns used spam and exploit kits, while later activity relied heavily on compromised websites, fake forum pages, and SEO poisoning to lure victims into downloading JavaScript-based loaders. Related delivery operations, often referred to as Gootloader, have targeted enterprise and government users and have been used as an initial-access channel for additional malware. Reported downstream payloads delivered in Gootkit-linked campaigns have included Cobalt Strike, Kronos, REvil, SunCrypt, and other criminal tooling, indicating a role beyond standalone banking theft.
Victimology has frequently centered on Europe, with notable activity against users in countries such as Germany and Italy, but later campaigns also targeted organizations in North America, South Korea, and Australia. Sector targeting has included banking, legal, government, healthcare, military, financial, pharmaceutical, automotive, and energy organizations. Gootkit has also been linked in reporting to operational overlap or cooperation with other financially motivated malware ecosystems, including DanaBot and broader loader-as-a-service activity.
Overall, Gootkit is best characterized as a mature, stealth-focused Windows banking trojan that expanded into a multifunctional infostealer and intrusion-enablement platform, combining credential theft, browser manipulation, persistence, defense evasion, and malware delivery in a long-running cybercrime ecosystem.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
We have observed final payloads including Ramnit, Gootkit, DarkVNC, Ursnif, and PsiXBot.
Delivered malware included ZLoader (a.k.a. Terdot), Gootkit, Ursnif, Corebot, Panda Banker, Atmos, Mazar Bot, and Red Alert Android malware.
Storm-0324 has distributed a range of first-stage payloads since at least 2016, including: ... Gootkit, a banking trojan
30 distinct techniques documented for this family, organized by ATT&CK tactic.
I was hunting for Gootkit (pushed in a Nuclear Pack instance in France those days) but instead I got a Teerac.A new crypto ransomware. Nuclear Pack pushing CryptoFortress via CVE-2013-2551 | Nuclear Pack pushing CryptoFortress via CVE-2013-2551
Initially it was distributed via spam and exploits kits such as Spelevo and RIG.
The emails include ZIP attachments, pre-downloaded from the attacker’s server, containing a decoy PDF file and a malicious VBS file.
The emails are crafted in the targeted country’s language and are often personalized to include recipients’ names and addresses in various parts of the email such as email body and subject. TA554 frequently uses package delivery or order notification lures; the emails contain URLs linking to zipped LNK files or zipped documents.
The Gootkit Banking Trojan was discovered back in 2014, and utilizes the Node.JS library to perform a range of malicious tasks.
Executing the VBS file leads to downloading further malware using a PowerShell command.
The emails include ZIP attachments... containing a decoy PDF file and a malicious VBS file. Executing the VBS file leads to downloading further malware using a PowerShell command.
The core component of Gootloader is a small js loader (2.8 KB) that acts as the first-stage of the infection chain.
the loader tries to find registry keys with the following format: HKCU\Software\AppDataLow\<pr_string>_<i> ... Each key contains a maximum chunk of 512,000 bytes (500KB) of encrypted data. | So Gootkit creates an .inf file in the same directory as the sample and writes the following values to the Software\Microsoft\IEAK\GroupPolicy\PendingGPOs registry key
If the sample is running under another account, it creates a service with a random name chosen from %SystemRoot%, copies itself into the %SystemRoot% folder with the chosen name and deletes itself from the disk.
iterates over the running processes and tries to inject the decrypted DLLs into the process memory of the designated process using the NtCreateSection/NtMapViewOfSection API.
The loader is composed of three highly obfuscated layers that contain encoded URLs.
iterates over the running processes and tries to inject the decrypted DLLs into the process memory of the designated process using the NtCreateSection/NtMapViewOfSection API.
Note that each “while” loop is performing string decryption on the sequences of bytes shown in the variables above the loop. When following the execution in a debugger, the strings are decrypted, and some meaningful indicators of VM checks are visible.
the Gootkit loader employs lots of different methods to detect virtual environments or debuggers. If any of the virtual machine checks succeed, the loader enters an infinite loop.
The rest of the checks include: Compare user name to "CurrentUser"/"Sandbox" Compare computer name to "SANDBOX"/"7SILVIA" HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion" compare with AMI, VirtualBox, BOCHS, INTEL 640000, 55274-640-2673064-23950, and other serials
the loader tries to find registry keys with the following format: HKCU\Software\AppDataLow\<pr_string>_<i> ... Each key contains a maximum chunk of 512,000 bytes (500KB) of encrypted data. | So Gootkit creates an .inf file in the same directory as the sample and writes the following values to the Software\Microsoft\IEAK\GroupPolicy\PendingGPOs registry key
Continuing on, Gootkit will query HARDWARE\DESCRIPTION\System\SystemBiosVersion and compare the value to; AMI, BOCHS, VBOX, QEMU... Yet another registry query is performed, this time with the key HARDWARE\Description\System\VideoBiosVersion.
the Gootkit loader employs lots of different methods to detect virtual environments or debuggers. If any of the virtual machine checks succeed, the loader enters an infinite loop.
The rest of the checks include: Compare user name to "CurrentUser"/"Sandbox" Compare computer name to "SANDBOX"/"7SILVIA" HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion" compare with AMI, VirtualBox, BOCHS, INTEL 640000, 55274-640-2673064-23950, and other serials
Gootkit is capable of stealing data from the browser, performing man-in-the-browser attacks, keylogging, taking screenshots
Over the last six years there has been an increased shift by malware authors to secure their C&C communications using the SSL/TLS protocol to stymie detection and blend in with normal traffic.
The response can be a simple acknowledgment or a longer set of instructions, a module or executable... In many cases the C2 server response only contains an updated version of the binary... If the victim is infected with the latest version of Emotet... the latest modules are downloaded.
Recently, we came across web malware that – instead of injecting an iframe pointing to a fixed existing address – generates a pseudo-random domain name, depending on the current date. This approach is not new and is widely used by botnets in C&C domain name generation.
99 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
53 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Gootkit is a banking trojan first reported in 2014 that uses Node.js components and supports persistence, C2-based loader updates, browser DLL injection, credential theft, web injections, video recording, and remote VNC-style access. In this sample it establishes persistence via either a created Windows service or an IEAK PendingGPO INF-based mechanism, disables Internet Explorer Protected Mode across zones, scans for browsers, and injects x86/x64 DLLs into targeted browser processes.
The State of SSL/TLS Certificate Usage in Malware C&C Communications AdWind ostap AsyncRAT BazarBackdoor BitRAT Buer Chthonic CloudEyE Cobalt Strike DCRat Dridex FindPOS GootKit Gozi IcedID ISFB Nanocore RAT Orcus RAT PandaBanker Qadars QakBot Quasar RAT Rockloader ServHelper Shifu SManager TorrentLocker TrickBot Vawtrak Zeus Zloader
Referenced as a possible secondary payload retrieved by JavaScript-based initial access malware.
Secondary payload referenced as being delivered by GootLoader; also referenced as the group frequently associated with GootLoader operations.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.