❌

Normal view

Before yesterdayMain stream

Threat Research – Sophos News
Gootloader inside out 16 January 2025 at 11:00

Gootloader inside out

Threat Research – Sophos News

By:Gabor Szappanos

16 January 2025 at 11:00

Open-source intelligence reveals the server-side code of this pernicious SEO-driven malware - without needing a lawyer afterward

A list of Gootloader JScript filenames, which correspond to the search query that led victims to download them

Gootloader has poisoned search results in multiple languages, including German, French, and Korean

Source of the Gootkit/Gootloader landing pages reveal a number of different search terms and phrases the threat actors wanted search engines to index. The linked subpages (selected with green) don't actually exist. The injected WordPress code defines a few hooks, one of them is for non-existing pages. This will serve the fake forum discussion, when the victim clicks on the search result

A screenshot of the source code from a Gootkit/Goodloader landing page. Image courtesy of Sucuri Research.

The WordPress database dump included this table that contains a set of the first three octets of IP addresses, a block list of IP ranges that cannot revisit the Gootloader website on the same day

A block of base64-encoded data stored as a variable named $pposte in a WordPress database

Malicious SEO content phrases embedded in a WordPress database table, linking the site to an Excel spreadsheet converter search query

The "place marker" string appears in the OpenGraph metadata SEO headers of a Gootkit/Gootloader-modified web page

Files that contain references to the Gootloader "mothership" website (screenshot courtesy of VirusTotal)

Commented text, preceded with double slashes, documents the Gootkit characteristics of modified web pages

a WordPress database dump in VirusTotal

A SQL dump from a compromised WordPress installation contains base64-encoded elements of the Gootkit/Gootloader modifications

The decoded base64 data from the WordPress database reveals the PHP script that handles decoding the malicious content for a site visitor

A simple command shell Gootkit inserts into the PHP running in a WordPress site the threat actors have comrpomised

The portion of the Gootkit code that collects the HTML content of the fake page it will later draw over the top of the compromised website

The Gootkit code blocks repeat visitors by adding not only the visitor's IP address range to a block list, but the entire class C IPv4 address range on either side of the visitor's address, just for good measure

The Gootkit/Gootloader fake forum page, featuring a "question" and an "answer" that links to the Gootloader JScript first-stage payload

The unique key is linked in a Javascript code snippet embedded in the compromised WordPress server page.

A set of commands that deletes from view the original page content on the compromised WordPress server page the visitor lands on

The replacement content includes the text of the "Questions And Answers" fake forum page

The download link points to a php script hosted on a different server. This link delivers the .js file packed into a Zip archive which comprises the first stage Gootloader payload

A Gootkit/Gootloader fake forum page in German. The source code of the page shows the link points to a file named down.php hosted on a completely different server than the one where the page appears. The link marked in red will connect to the server that is hosting the first-stage download JScript.

The source code of the PHP script that delivers the first stage Gootloader payload

Screenshot of the modified HelloDolly.php script (courtesy of the Rich Infante blog)

Another format of the modified HelloDolly.php script shows the unique identifier string

A variation on the modified HelloDolly.php script

A screenshot that summarizes the modification process Gootloader uses (image courtesy of the Rich Infante blog)

A WordPress database dump contains the same elements that the Rich Infante blog references

The encoded form of a PHP script that delivers the .js payload

A screenshot of a file uploaded to VirusTotal shows references to the IP address formerly used to host the Gootkit/Gootloader "mothership" server

The my-game website as it appeared in 2014, a Russian-language gambling site called "Casino Game Life"

The my-game domain that continues to host the Gootkit/Gootloader mothership originally belonged to a German team that played the game Counter-Strike competitively