{ "family": "gootkit", "sample_count": 13, "category": "trojan", "description": "Gootkit (cataloged as Trojan:Win32/Gootkit, Trojan.Gootkit, Win32/Gootkit, and intimately intertwined with the GootLoader infection framework) is an advanced, modular malware family first discovered in 2014, distinguished by one of the most unusual and technically complex architectures in contemporary crimeware: embedding an entire NodeJS runtime engine inside a 32-bit and 64-bit Windows PE binary. Rather than relying on compiled native code for its core business logic, Gootkit utilizes a multi-megabyte C++ loader whose sole responsibility is to unpack an embedded NodeJS engine directly into memory. Once initialized, the embedded V8 runtime executes extensive JavaScript payloads that perform rigorous anti-analysis checks, hypervisor detection (VMware, VirtualBox, QEMU), sandbox timing measurements, and API hooking. Gootkit stores serialized JavaScript scripts and configuration blobs directly in the Windows Registry (such as HKCU\\Software\\AppDataLow\\Software\\Microsoft\\), completely bypassing traditional file-on-disk antivirus heuristic scans. Gootkit functions as both a high-tier banking trojan—hooking browser network APIs to conduct Man-in-the-Browser (MitB) financial diversion—and an information stealer harvesting corporate credentials and cryptographic keys. In late 2020, the operators decoupled the infection mechanism into 'GootLoader', an enterprise-grade initial-access distribution network driven by search engine optimization (SEO) poisoning. By compromising thousands of legitimate WordPress blogs and inserting dynamic fake message boards containing keywords like 'agreement template', 'contract sample', and 'legal release', GootLoader lures corporate employees into downloading malicious ZIP archives containing obfuscated JScript scripts. These scripts ultimately stage Cobalt Strike beacons, REvil, and Gootkit implants across corporate networks.", "cta": "Published by the SystemHelpdesk threat intelligence team.", "aliases": [ "Trojan:Win32/Gootkit", "Trojan.Gootkit", "GootLoader", "Win32/Gootkit", "Gootkit Banking Trojan" ], "enrichment_level": "curated_sourced", "faq": [ { "@type": "Question", "name": "What makes Gootkit's technical architecture unique?", "acceptedAnswer": { "@type": "Answer", "text": "Gootkit embeds a complete NodeJS JavaScript runtime environment directly within its Windows executable binary. This allows the malware to execute its entire evasion logic, browser hooking, and C2 communication using obfuscated JavaScript parsed by Google's V8 engine in memory." } }, { "@type": "Question", "name": "How does Gootkit evade antivirus file scanning?", "acceptedAnswer": { "@type": "Answer", "text": "Gootkit writes its secondary and tertiary JavaScript execution payloads into multi-megabyte registry entries under HKCU\\Software\\AppDataLow\\ rather than saving files to the hard drive, achieving effective fileless registry-based persistence." } }, { "@type": "Question", "name": "What is GootLoader and how does it relate to Gootkit?", "acceptedAnswer": { "@type": "Answer", "text": "GootLoader is the sophisticated loader and initial-access framework developed by the Gootkit threat group. It uses SEO poisoning to deliver multi-stage obfuscated JavaScript droppers that deploy Gootkit, Cobalt Strike, SystemBC, and ransomware payloads onto enterprise networks." } }, { "@type": "Question", "name": "How does GootLoader SEO poisoning operate?", "acceptedAnswer": { "@type": "Answer", "text": "Attackers compromise legitimate WordPress websites and inject fake Q&A forum pages optimized for business search queries (e.g., 'non-disclosure agreement template'). When targeted corporate users visit via Google, the site serves a malicious ZIP file disguised as the requested document." } }, { "@type": "Question", "name": "What capabilities does Gootkit possess on compromised workstations?", "acceptedAnswer": { "@type": "Answer", "text": "Gootkit features Man-in-the-Browser web injection, video screen recording, keylogging, offline password extraction from web browsers and email clients, and reverse proxy tunneling to route attacker traffic through infected corporate subnets." } }, { "@type": "Question", "name": "How can security operations hunt for Gootkit and GootLoader?", "acceptedAnswer": { "@type": "Answer", "text": "Monitor process execution of cscript.exe or wscript.exe executing files from %TEMP% or Downloads, look for oversized registry keys created in HKCU\\Software\\AppDataLow\\, and inspect outbound web traffic for NodeJS HTTP headers contacting suspicious IP addresses." } }, { "@type": "Question", "name": "How does Gootkit incorporate a bundled NodeJS JavaScript runtime engine within its binary?", "acceptedAnswer": { "@type": "Answer", "text": "Unlike standard C/C++ Trojans, Gootkit embeds a complete, customized NodeJS JavaScript runtime engine directly inside its binary payload. Its core operational logic—including Man-in-the-Browser web injects, credential parsing, and network communication—is written in heavily obfuscated JavaScript executed natively by the embedded NodeJS interpreter, posing significant challenges for traditional binary disassemblers." } }, { "@type": "Question", "name": "What SEO poisoning tactics does the Gootkit/GootLoader threat group use to bait users searching for corporate templates?", "acceptedAnswer": { "@type": "Answer", "text": "The threat actors behind GootLoader compromise thousands of legitimate WordPress websites, using search engine optimization (SEO) poisoning to elevate malicious blog posts to top Google rankings for queries involving legal agreements, contracts, and business templates. When a user visits the compromised page from a search engine referrer, they are presented with a fake forum thread providing a malicious download link that launches the multi-stage GootLoader infection chain." } } ], "faq_count": 8, "mitre_attack": [ "T1189", "T1185", "T1059.001", "T1055", "T1547.001", "T1071.001", "T1105", "T1112" ], "cisa_advisory": null, "exploited_cves": [], "last_updated": "2026-10-16", "sources": [ { "name": "SentinelOne: In-Depth Analysis of GootLoader and Gootkit", "url": "https://www.sentinelone.com/blog/gootloader-the-complex-modular-loader-powering-gootkit-and-ransomware/" }, { "name": "Mandiant: Gootkit Banking Trojan and SEO Poisoning Campaigns", "url": "https://www.mandiant.com/resources/blog/gootkit-banking-trojan-seo-poisoning" }, { "name": "SophosLabs: GootLoader SEO Poisoning Techniques and Payloads", "url": "https://news.sophos.com/en-us/2021/03/01/gootloader-expands-its-payload-delivery-options/" }, { "name": "Trend Micro: Gootkit Node.js Architecture Deep Dive", "url": "https://www.trendmicro.com/en_us/research/19/d/gootkit-trojan-analyzed.html" } ], "iocs": { "file_hashes": [ "4591a27e7f606771ef812bf087b92f758f27694931a1ec67a3a30386cfb81045", "d8a23072fbc043015f8ba81b4d084bc9103ee65a6f272a27546857ea5681023a", "3bc1f7a82910fa8d62650f146be545df990bbf8d82136e090a88b5a190ef7621" ], "delivery": [ "GootLoader search engine optimization (SEO) poisoning targeting corporate business agreement queries", "Hacked WordPress websites hosting fake message board templates delivering malicious ZIP archives", "Obfuscated multi-stage JavaScript (.js) files executed via Windows Script Host (wscript.exe)" ], "persistence": [ "Large serialized JavaScript execution strings stored across multiple Windows Registry entries under HKCU\\Software\\AppDataLow\\", "Scheduled tasks triggering rundll32.exe or cscript.exe from %APPDATA%\\Local\\", "Process injection into legitimate system processes (svchost.exe, explorer.exe)" ] }, "lineage": { "derived_from": [ "xswkit" ], "variants": [ "gootloader", "gootkit_nodejs_v1", "gootkit_v2" ] }, "ecosystem": [ "windows", "windows_pe" ], "attack_stage": [ "initial_access", "execution", "persistence", "defense_evasion", "credential_access", "discovery", "collection", "command_and_control" ], "target_platforms": [ "Windows 11", "Windows 10", "Windows 7" ] }