New Gootloader Malware Abuses RDP to Spread Rapidly

Hackers target Remote Desktop Protocol (RDP) via malware because it provides them with remote access to a victim’s computer or network, allowing them to:-

• Steal data
• Deploy ransomware
• Conduct other malicious activities

Cybersecurity researchers at IBM X-Force affirmed recently that in place of conventional frameworks like CobaltStrike, the Gootloader group unveiled GootBot, a new tool for C2 and lateral movement.

Gootloader Malware Abuses RDP

GootBot, a stealthy Gootloader variant for lateral movement, complicates detection. The group uses SEO poisoning to target victims, introducing their custom bot to avoid detections while rapidly spreading and deploying payloads.

GootBot is expanding its post-infection capabilities, enabling threat actors to remain hidden for longer by running encrypted PowerShell scripts. Besides this, Gootloader was previously usually utilized for initial access.

GootBot is a lean PS script with a single C2 server that infiltrates enterprise domains via hacked WordPress sites, posing a risk with undetected activity, reads the IBM X-Force report.

Hive0127 (aka UNC2565) has been active since 2014 and deploys Gootloader via SEO poisoning and hacked WordPress sites, enabling ransomware and more.

Gootloader begins with a user downloading an infected archive, leading to obfuscated JavaScript files placed strategically in %APPDATA%.

This virus uses stages that collect data and connect with compromised WordPress-based C2 servers to schedule activities for persistence and allow dynamic PowerShell execution.

Moreover, this new variant is a lightweight PowerShell script with a single C2 server, enabling:-

• Asynchronous execution
• Lower EDR detection

GootBot beacons every 60 seconds, adjustable with a specific string. It handles task results for child jobs from the C2, sending ‘E1’ for incomplete jobs and ‘E2’ for missing ones.

A modulo-based approach is used to obscure the string after Base64 encoding, which is similar to the trick used by Gootloader.

GootBot sends POST requests to its C2 server, splitting data if it’s over 100,000 chars. It spreads laterally, using various techniques to infect hosts. 

Its C2 generates diverse payloads and deploys them automatically. WinRM, SMB, and WinAPI are used for lateral movement. 

Environment variables store encrypted strings, reducing script size. GootBot spoofs PowerShell process arguments by creating new processes.

Protect Your Storage With SafeGuard

Is Your Storage & Backup Systems Fully Protected? – Watch 40-second Tour of SafeGuard

StorageGuard scans, detects, and fixes security misconfigurations and vulnerabilities across hundreds of storage and backup devices.

Try StorageGuard for Free

GootBot also runs a reconnaissance script that collects the following data:-

• Domain user name
• OS (from registry key)
• If 64bit architecture (checking for x86 dir and also size of int ptr)
• Domain controllers
• Running processes
• SID
• Local IP address
• Hostname

Recommendations

Here below, we have mentioned all the recommendations offered by the security researchers:-

• Make sure to keep the AV tools updated with the latest available security updates.
• Enable script block logging.
• Monitor Windows event logs for security indicators.
• Watch for JavaScript file execution in downloaded ZIPs.
• Make sure to keep your eyes on “wscript.exe” launching JavaScript files with short names like (*~1.JS) in scheduled tasks.
• Monitor HTTP traffic for suspicious requests ending in “xmlrpc.php” URLs.
• Suspicious cookie value: <BOT_ID>=<If user is admin: 0/1>
• Suspicious content format: <BOT_ID>=[sX<<random_int>><packet_seq_number>]<data>
• Always remain vigilant for lateral movement through WinRM, WMI or SCM.
• Within your environment, make sure to disable or monitor the “Start-Job” Cmdlet.

Patch Manager Plus, the one-stop solution for automated updates of over 850 third-party applications: Try Free Trial.