SentinelOne Gootloader June 2021

Gootloader can use an embedded script to check the IP address of potential victims visiting compromised websites.

The Gootloader first stage script is obfuscated using random alpha numeric strings.

Gootloader can inject its Delphi executable into ImagingDevices.exe using a process hollowing technique.

Gootloader can use an encoded PowerShell stager to write to the Registry for persistence.

Gootloader can execute a Javascript file for initial infection.

Gootloader can determine if a targeted system is part of an Active Directory domain by expanding the %USERDNSDOMAIN% environment variable.

Gootloader can fetch second stage code from hardcoded web domains.

Gootloader can retrieve a Base64 encoded stager from C2.

Gootloader has the ability to decode and decrypt malicious payloads prior to execution.

Gootloader has been executed through malicious links presented to users as internet search results.

Gootloader has used compromised legitimate domains to as a delivery network for malicious payloads.

Gootloader can insert malicious scripts to compromise vulnerable content management systems (CMS).

Gootloader can use IP geolocation to determine if the person browsing to a compromised site is within a targeted territory such as the US, Canada, Germany, and South Korea.