Researchers identified a fresh Gootloader variant named “GootBot” that adds lateral movement and stealth to post-infection activity. It uses hardcoded C2 servers on compromised WordPress sites and avoids common off-the-shelf tools to deploy additional payloads, signaling a shift in threat tactics. Hashtags: #Gootloader #GootBot #UNC2565 #Hive0127 #CobaltStrike #IcedID #SystemBC #WordPress #XMLRPC
Keypoints
- GootBot is a new Gootloader variant that enables efficient network infiltration and payload deployment after infection.
- Gootloader/UNC2565/Hive0127 expanded tactics since 2022, distributing secondary payloads like Cobalt Strike, IcedID, and SystemBC.
- GootBot uses a single hardcoded C2 server per payload, often hosted on compromised WordPress sites, to evade detection.
- Infection begins with an infected archive containing a heavily obfuscated JavaScript file, leading to scheduled tasks, PowerShell, and data exfiltration to C2 servers.
- Post-infection, GootBot conducts lateral movement (WinRM, SMB, remote services) and may reuse stolen credentials to spread.
- SOCRadar/XTI and Mandiant IoCs detail a broad set of indicators including file hashes, registry payloads, and network domains related to Gootloader campaigns.
MITRE Techniques
- [T1189] Drive-by Compromise – The campaigns employ SEO poisoning to lure victims to compromised websites where they unwittingly download the initial payload. ‘campaigns employing SEO poisoning attacks… luring victims to seemingly legitimate websites where they unwittingly download the initial payload.’
- [T1027] Obfuscated/Compressed Files and Information – The initial infection involves a heavily obfuscated JavaScript file in an infected archive. ‘a heavily obfuscated JavaScript file, which is Gootloader’s first stage.’
- [T1053.005] Scheduled Task – Infections trigger a scheduled task for execution and persistence. ‘triggers a scheduled task for execution and persistence.’
- [T1059.001] PowerShell – Multiple stages involve PowerShell scripts, including the third stage that runs PowerShell payloads. ‘the third stage, which collects system information and uploads it to one of its 10 hardcoded C2 servers’ and ‘PowerShell script’ and ‘Start-Job’ usage.
- [T1071.001] Web Protocols – C2 communication occurs via HTTP GET requests to retrieve PowerShell tasks. ‘GootBot sends a GET request to its C2 server, requesting PowerShell tasks.’
- [T1082] System Information Discovery – The payload collects system information as part of reconnaissance. ‘The third stage PowerShell script runs in an endless loop, enabling the actor to receive various PowerShell payloads from the C2.’ and ‘collects domain user names, OS information, architecture details, domain controller information, running processes, SIDs, local IP addresses, hostnames, and formats the data with the specified ID.’
- [T1021.006] Windows Remote Management (WinRM) – Lateral movement uses WinRM in PowerShell. ‘WinRM in PowerShell.’
- [T1021.002] SMB/Windows Admin Shares – Payloads are copied via SMB during lateral movement. ‘copying payloads via SMB.’
- [T1543.003] Create/Modify System Process: Windows Service – Remote services and scheduled tasks are created or manipulated via WinAPI calls. ‘using WinAPI calls for creating remote services and scheduled tasks.’
- [T1078] Valid Accounts – Exfiltrated credentials are used to spread within the environment. ‘exfiltrated credentials for spreading.’
- [T1036] Masquerading – Spoofing PowerShell process arguments by creating a new process before writing to stdin. ‘spoof PowerShell process arguments by creating a new process before writing the malicious script to the process’s standard input.’
Indicators of Compromise
- [File Hash] ZIP – 1011b2cbe016d86c7849592a76b72853, 80a79d0c9cbc3c5188b7a247907e7264, and 1 more item
- [File Hash] JS – 82607b68e061abb1d94f33a2e06b0d20, 961cd55b17485bfc8b17881d4a643ad8, and 4 more items
- [Registry Payload 1] – FONELAUNCH.FAX – d6220ca85c44e2012f76193b38881185, and 2 more items
- [Registry Payload 2] – Cobalt Strike BEACON – 04746416d5767197f6ce02e894affcc7, 2eede45eb1fe65a95aefa45811904824, and 3 more items
- [Network] C2 Domains – jonathanbartz[.]com, kepw[.]org, and 5 more domains
- [Cobalt Strike Beacon Backdoor] – 108.61.242[.]65/dot.gif, 108.61.242[.]65/submit.php, and 8 more addresses
Read more: https://socradar.io/new-gootloader-variant-gootbot-changes-the-game-in-malware-tactics/