Procedure examples

Gootloader can use an embedded script to check the IP address of potential victims visiting compromised websites.

The Gootloader first stage script is obfuscated using random alpha numeric strings.

Gootloader can use its own PE loader to execute payloads in memory.

Gootloader can inject its Delphi executable into ImagingDevices.exe using a process hollowing technique.

Gootloader can use an encoded PowerShell stager to write to the Registry for persistence.

Gootloader can execute a Javascript file for initial infection.

Gootloader can determine if a targeted system is part of an Active Directory domain by expanding the %USERDNSDOMAIN% environment variable.

Gootloader can inspect the User-Agent string in GET request header information to determine the operating system of targeted systems.

Gootloader can fetch second stage code from hardcoded web domains.

Gootloader can retrieve a Base64 encoded stager from C2.

Gootloader has the ability to decode and decrypt malicious payloads prior to execution.

Gootloader has been executed through malicious links presented to users as internet search results.

Gootloader can designate a sleep period of more than 22 seconds between stages of infection.

Gootloader can create an autorun entry for a PowerShell script to run at reboot.

Gootloader has used compromised legitimate domains to as a delivery network for malicious payloads.

Gootloader can insert malicious scripts to compromise vulnerable content management systems (CMS).

Gootloader can use IP geolocation to determine if the person browsing to a compromised site is within a targeted territory such as the US, Canada, Germany, and South Korea.

Gootloader can determine if a victim's computer is running an operating system with specific language preferences.