Rewterz Threat Alert – Gootloader – Active IOCs

Severity

High

Analysis Summary

GootLoader – a multi-staged JavaScript malware package, has been seen in the wild since late 2020. It initially gained popularity as a sophisticated multi-staged downloader of GootKit malware. This dropper’s payload delivery has progressed over time, and its payload capabilities have expanded beyond only distributing its namesake malware. 
GootLoader leverage SEO poisoning tactics to prominently promote links to its malware in internet search results, drawing in as many unknowing victims as possible. The group was also seen utilizing overlays to show a fake forum page over blog articles with highly targeted material related to government, finances, legal, healthcare, and education.

Impact

• Information Theft
• Unauthorized Access
• SEO Poisoning

Indicators of Compromise

MD5

• fa7bf219306dff2647e61e74c4681950
• 5d1faa9587f5529b4a14cb3ab325fcd0
• 99582ec8d1caef6d039267ae661d9cbe

SHA-256

• 79a12d894597cdd3fc4b129ad5b4423a1754f51d6eb02a96064135268d805886
• 242b353275230ec218cf5c77178d31651664cea6ea31086160fad886c53d1b61
• 15673597fe0a51d3ea4f8de933d7f5cf8619066ddec48e5d9d6d795eb3d3851d

SHA-1

• 6b53ee2355ba4e4e6317bfce464a49444df4a241
• 67b6a4bcf7dbe355bc132c960a1b68f89195cc6b
• 5ed5a308713c2dd58495a6e15768cd2cfb30ad2b

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Never trust or open ” links and attachments received from unknown sources/senders.
• Do not download document ?les attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.