Gootkit

Category: trojan · Aliases: Trojan:Win32/Gootkit, Trojan.Gootkit, GootLoader, Win32/Gootkit, Gootkit Banking Trojan · Sample count (EMBER 2018): 13 · Enrichment: curated_sourced · Updated: 2026-10-16
Category: TrojanStatus: Automated SignaturePlatform: WINDOWS, WINDOWS_PEStage: Initial Access, Execution, Persistence, Defense Evasion, Credential Access, Discovery, Collection, Command And Control🕸 Explore Relationship Graph⚙ API JSON⚡ Sigma Rule💾 YARA RuleOS: Windows 11, Windows 10, Windows 7
Executive Summary
Gootkit (cataloged as Trojan:Win32/Gootkit, Trojan.Gootkit, Win32/Gootkit, and intimately intertwined with the GootLoader infection framework) is an advanced, modular malware family first discovered in 2014, distinguished by one of the most unusual and technically complex architectures in contemporary crimeware: embedding an entire NodeJS runtime engine inside a 32-bit and 64-bit Windows PE binary.

Table of Contents

Overview

Gootkit (cataloged as Trojan:Win32/Gootkit, Trojan.Gootkit, Win32/Gootkit, and intimately intertwined with the GootLoader infection framework) is an advanced, modular malware family first discovered in 2014, distinguished by one of the most unusual and technically complex architectures in contemporary crimeware: embedding an entire NodeJS runtime engine inside a 32-bit and 64-bit Windows PE binary. Rather than relying on compiled native code for its core business logic, Gootkit utilizes a multi-megabyte C++ loader whose sole responsibility is to unpack an embedded NodeJS engine directly into memory. Once initialized, the embedded V8 runtime executes extensive JavaScript payloads that perform rigorous anti-analysis checks, hypervisor detection (VMware, VirtualBox, QEMU), sandbox timing measurements, and API hooking. Gootkit stores serialized JavaScript scripts and configuration blobs directly in the Windows Registry (such as HKCU\Software\AppDataLow\Software\Microsoft\), completely bypassing traditional file-on-disk antivirus heuristic scans. Gootkit functions as both a high-tier banking trojan—hooking browser network APIs to conduct Man-in-the-Browser (MitB) financial diversion—and an information stealer harvesting corporate credentials and cryptographic keys. In late 2020, the operators decoupled the infection mechanism into 'GootLoader', an enterprise-grade initial-access distribution network driven by search engine optimization (SEO) poisoning. By compromising thousands of legitimate WordPress blogs and inserting dynamic fake message boards containing keywords like 'agreement template', 'contract sample', and 'legal release', GootLoader lures corporate employees into downloading malicious ZIP archives containing obfuscated JScript scripts. These scripts ultimately stage Cobalt Strike beacons, REvil, and Gootkit implants across corporate networks.

Known aliases

Threat reports may refer to this family under multiple names:

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Derived From / Upstream Ancestry: Xswkit

Known Derivatives & Downstream Variants: Gootloader · Gootkit_Nodejs_V1 · Gootkit_V2

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1189 · T1185 · T1059.001 · T1055 · T1547.001 · T1071.001 · T1105 · T1112

→ Explore the complete 226-Technique ATT&CK Threat Matrix

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

D3FEND IDCountermeasure NameTacticCountered ATT&CKDefensive Guidance
D3-PIADProcess Injection Analysis & DetectionDetectT1055Monitor cross-process thread creation (CreateRemoteThread) and asynchronous procedure calls (QueueUserAPC).
D3-PSBLPowerShell Script Block LoggingDetectT1059.001Enable PowerShell event ID 4104 and Constrained Language Mode to neuter obfuscated script payloads.
D3-WAFWeb Content Filtering & InspectionFilterT1071.001Block newly registered domains (NRDs) and inspect HTTP Host and URI headers for known C2 profiles.
D3-NTINetwork Traffic InspectionDetectT1105Inspect deep packet payloads for anomalous staging binaries and unauthorized egress protocols.
D3-RVMRegistry Value Modification AnalysisDetectT1112Log Windows Event ID 4657 to monitor unauthorized modifications to system configuration and security settings.
D3-MitBAMan-in-the-Browser AnalysisDetectT1185Deploy browser extension whitelisting and hardware-backed session binding to prevent rogue DOM and socket injection.
D3-RBIRemote Browser IsolationIsolateT1189Execute untrusted web browsing sessions in disposable cloud containers to isolate drive-by exploits from local endpoints.
D3-RPMRegistry Persistence MonitoringDetectT1547.001Audit and restrict write privileges to user and machine-level Registry Run/RunOnce keys using Endpoint Privilege Management.

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

Delivery vectors

Persistence mechanisms

SIEM / EDR Ingestion: Need these reference indicators for threat hunting?

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

Tier 1 Primitive Artifact Rule (Fast Triage)

Matches raw strings and file markers. Vulnerable to binary repacking and simple obfuscation.

rule MALWARE_WIN_GOOTKIT_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Gootkit"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "gootkit" ascii wide nocase
        $s2 = "trojan:win32/gootkit" ascii wide nocase
        $s3 = "trojan.gootkit" ascii wide nocase
        $s4 = "gootloader" ascii wide nocase
        $s5 = "win32/gootkit" ascii wide nocase
        $s6 = "gootkit banking trojan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Tier 2 Behavioral Context Rule (Process Chains & Sigma)

Tracks parent-child process anomalies and suspicious scripting telemetry. Resilient against file renames.

title: SystemHelpDesk Detection - Gootkit (Trojan) Execution & Triage
id: 1a274645-d17a-5fac-9d92-36df4bbe914e
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Gootkit malware family. Detects suspicious execution from temporary user
  directories with hidden window flags and background transfer utilities.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/gootkit
- https://malware-families-catalog.systemhelpdesk.com/defensive/downloader-dropper-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.trojan
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1189
- attack.t1185
- attack.t1059_001
- attack.t1055
- attack.t1547_001
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
    CommandLine|contains:
    - AppData\Local\Temp
    - -WindowStyle Hidden
    - /e:jscript
    - bitsadmin /transfer
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: medium

Tier 3 Attribution Fingerprint Rule (High Fidelity)

Deep signature matching distinctive operational fingerprints and payload characteristics.

rule MALWARE_WIN_GOOTKIT_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Gootkit tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "gootkit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}
SOC & SIEM Rule Downloads: ⬇ Download YARA Rule (.yar) ⬇ Download Sigma Rule (YAML) ⬇ Download Sigma Rule (JSON) ⚙ Threat Profile API (JSON)

References & External Analysis

Frequently Asked Questions

What makes Gootkit's technical architecture unique?

Gootkit embeds a complete NodeJS JavaScript runtime environment directly within its Windows executable binary. This allows the malware to execute its entire evasion logic, browser hooking, and C2 communication using obfuscated JavaScript parsed by Google's V8 engine in memory.

How does Gootkit evade antivirus file scanning?

Gootkit writes its secondary and tertiary JavaScript execution payloads into multi-megabyte registry entries under HKCU\Software\AppDataLow\ rather than saving files to the hard drive, achieving effective fileless registry-based persistence.

What is GootLoader and how does it relate to Gootkit?

GootLoader is the sophisticated loader and initial-access framework developed by the Gootkit threat group. It uses SEO poisoning to deliver multi-stage obfuscated JavaScript droppers that deploy Gootkit, Cobalt Strike, SystemBC, and ransomware payloads onto enterprise networks.

How does GootLoader SEO poisoning operate?

Attackers compromise legitimate WordPress websites and inject fake Q&A forum pages optimized for business search queries (e.g., 'non-disclosure agreement template'). When targeted corporate users visit via Google, the site serves a malicious ZIP file disguised as the requested document.

What capabilities does Gootkit possess on compromised workstations?

Gootkit features Man-in-the-Browser web injection, video screen recording, keylogging, offline password extraction from web browsers and email clients, and reverse proxy tunneling to route attacker traffic through infected corporate subnets.

How can security operations hunt for Gootkit and GootLoader?

Monitor process execution of cscript.exe or wscript.exe executing files from %TEMP% or Downloads, look for oversized registry keys created in HKCU\Software\AppDataLow\, and inspect outbound web traffic for NodeJS HTTP headers contacting suspicious IP addresses.

How does Gootkit incorporate a bundled NodeJS JavaScript runtime engine within its binary?

Unlike standard C/C++ Trojans, Gootkit embeds a complete, customized NodeJS JavaScript runtime engine directly inside its binary payload. Its core operational logic—including Man-in-the-Browser web injects, credential parsing, and network communication—is written in heavily obfuscated JavaScript executed natively by the embedded NodeJS interpreter, posing significant challenges for traditional binary disassemblers.

What SEO poisoning tactics does the Gootkit/GootLoader threat group use to bait users searching for corporate templates?

The threat actors behind GootLoader compromise thousands of legitimate WordPress websites, using search engine optimization (SEO) poisoning to elevate malicious blog posts to top Google rankings for queries involving legal agreements, contracts, and business templates. When a user visits the compromised page from a search engine referrer, they are presented with a fake forum thread providing a malicious download link that launches the multi-stage GootLoader infection chain.

How do I remove the Gootkit Trojan from Windows?

Manual removal of Gootkit is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.

Is Gootkit a virus or a Trojan?

Gootkit is classified as a Trojan. Unlike traditional viruses that infect files, modern malware like Gootkit typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.

What are the main symptoms of a Gootkit infection?

Symptoms of Gootkit can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.

Protect Your Network Against Trojans

Want to prevent Gootkit and similar threats from compromising your organization? Read our comprehensive defensive guide: Banking Trojan Protection for Businesses.

📣 Threat Intel Correction or Update?

Notice an outdated IOC, unlisted alias, or disputed attribution? Threat researchers are invited to propose an update on GitHub or contact the SystemHelpDesk research desk. All community revisions are credited in our public CHANGELOG.

Need help with an active incident? Published by the SystemHelpdesk threat intelligence team.

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/gootkit.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.