{
  "family": "gootkit",
  "sample_count": 13,
  "category": "ransomware",
  "description": "Trojan:Win32/Gootkit (also tracked under names related to Gootloader) is a highly sophisticated, multi-stage Banking Trojan, Information Stealer, and Initial Access payload. Emerging around 2014, Gootkit is unique among banking trojans because its core malicious logic and banking web-injects are written almost entirely in JavaScript/Node.js, executed via an embedded Node.js interpreter, making static analysis extremely difficult.<br><br><b>Understanding Gootkit</b><br>To an infected user, Gootkit is invisible until their online banking session is hijacked. For a threat intelligence analyst, Gootkit is a masterclass in obfuscation and modularity. The developers constantly shift their infection vectors (currently relying heavily on 'Search Engine Optimization (SEO) Poisoning' to deliver malicious ZIP files to users searching for business templates). Once established, Gootkit's embedded Node.js engine allows the attackers to push dynamic, on-the-fly script updates to the malware, completely changing its behavior without deploying a new executable.<br><br><b>Execution and Node.js Mechanics</b><br>Modern Gootkit infections often begin with a user downloading a weaponized ZIP file (the 'Gootloader' phase) found via poisoned Google search results (`T1189`). The ZIP contains a heavily obfuscated JavaScript file (`T1027.002`). When executed via WScript, this loader performs extensive anti-analysis checks (checking the registry for VMWare/VirtualBox artifacts) (`T1497.001`). It then reaches out to compromised WordPress sites (`T1105`) to download the massive Gootkit payload. The payload establishes persistence via Scheduled Tasks (`T1053.005`) or Registry Run keys. Crucially, the payload contains a full Node.js runtime. It launches `node.exe` (often renamed or injected into a legitimate process) and feeds it the malicious JavaScript core (`T1059.007`). This Node.js script handles all C2 communications, intercepts browser traffic (Man-in-the-Browser), injects fake banking login fields (`T1056.002`), and exfiltrates stolen credentials.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe financial fraud and potential deployment of secondary ransomware (like REvil, which Gootloader frequently distributed). Incident responders should monitor EDR for the execution of WScript or CScript launching heavily obfuscated `.js` files from temporary directories. Anomalous network traffic (often encrypted TCP over custom ports) originating from injected processes (like `explorer.exe`) is a strong indicator. Memory dumping is required to extract the running Node.js scripts.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1027.002",
    "T1059.007",
    "T1056.002",
    "T1189",
    "T1497.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1059.007",
      "name": "Command and Scripting Interpreter: JavaScript/JScript (Node.js)",
      "tactic": "Execution"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise (SEO Poisoning)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1497.001",
      "name": "Virtualization/Sandbox Evasion: System Checks",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1056.002",
      "name": "Input Capture: GUI Input Capture (Web Injects)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1027.002",
      "name": "Obfuscated Files or Information: Software Packing",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint; an active Gootkit infection means the attacker is likely monitoring banking sessions in real-time or preparing to deploy ransomware.",
    "Assume all credentials typed on the machine (corporate passwords, banking logins) are compromised and enforce immediate enterprise-wide password resets.",
    "Capture a full forensic memory image (RAM dump) to extract the injected Node.js engine and the JavaScript configuration files dictating its targets.",
    "Do not trust the operating system; perform a complete bare-metal wipe and reinstall."
  ],
  "what_to_avoid": [
    "Do not assume multi-factor authentication (MFA/SMS) will protect you; Gootkit uses web injects to socially engineer the user into typing the MFA code into a fake prompt.",
    "Avoid relying solely on file hashes, as Gootloader generates unique, obfuscated JavaScript droppers for nearly every victim."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}