The JavaScript-based malware loader GootLoader has adopted a novel anti-analysis technique that abuses malformed ZIP archives to evade security detection while still functioning seamlessly on Windows systems.
According to Expel security researcher Aaron Walton, the threat actor deliberately crafts ZIP files that most popular extraction tools cannot reliably process.
“Many unarchiving tools are not able to consistently extract it, but the default tool built into Windows systems works consistently and reliably,” Walton explained.
The method blocks automated malware analysis tools like WinRAR and 7-Zip that use the Standard ZIP File Format while still allowing victims to use Windows’ native file explorer (I.e., Windows Explorer) to extract the archive and access the malicious content inside.
There are many techniques for achieving this result through multiple levels of evasion:
1. Creating multiple concatenated (e.g. 500-1000) ZIP archives as one malformed file
2. Clearing the End of Central Directory (EOCD) information from the ZIP archive
3. Using random values in non-critical ZIP fields (i.e. Disk #, # of Disks etc.) to cause most ZIP parsing errors by other types of ZIP parsers, while enabling successful operation of Windows’ built-in ZIP extraction function.
4. This also enables hashbusting. This means that:
A. Every victim receives a different unique ZIP archive
B. Hash-based detection and threat sharing will not work
C. Both the ZIP file and the JavaScript payload embedded in the ZIP have different random hashes
Advanced Delivery and Obfuscation Chain
The Malformed ZIP Technique is an evasion technique that employs layered techniques, which include:
1. Taking between 500 and 1,000 ZIP archives and concatenating them together into one large malformed ZIP file, which makes it possible to bypass the restrictions of most ZIP parser applications
2. Truncating the End of Central Directory (EOCD) record, thus removing the required bytes needed for ZIP parsers to work
3. Randomizing the values of the non-critical parts of the ZIP file such as the disk number and the number of disks.
It has been determined that the result of these manipulations is that the majority of ZIP parser applications fail but that Windows’ native extractor does function. Furthermore, it also enables the "hash busting" technique, which provides a unique ZIP file for every victim as well as makes hash-based detection and threat-sharing efforts ineffective. In addition to this, both the ZIP file and the embedded JavaScript generally have random hashes.
The Advanced Delivery and Obfuscation Chain is created through the delivery of the ZIP file (malware) as an XOR-encoded blob, which the victim's browser decodes, and continues appending the .zip data until it reaches the desired size.
Through this method, malware is able to overcome various types of security measures, including, but not limited to:
1. By circumventing network security measures (e.g. firewalls);
2. By evading detection through ZIP files transmitted over the internet; and
3. By simply using a compromised WordPress site to deliver the malware to its victims.
GootLoader campaigns most frequently utilize:
1. SEO Poisoning
2. Malvertising
3. Fake Legal Document Searches (Contracts, Agreements, Templates)
Persistence and Execution Processes:
The victim Double Clicks on the ZIP file and the first three steps listed below Occur:
1. Windows File Explorer opens the archived contents without extracting them.
2. An embedded JavaScript (JS) file is run by wscript.exe.
3. A Startup Folder (LNK) file is created by the malware that creates a persistent location to execute the malware when the user logs in.
4. It uses cscript.exe to execute a secondary JavaScript payload.
5. It executes PowerShell to collect information about the infected computer and obtain additional payloads such as ransomware and RATs.
Defensive Recommendations:
To mitigate the likelihood of a GootLoader-style Attack, organizations are encouraged to:
1. Block wscript.exe and cscript.exe from executing downloaded scripts
2. Use Group Policy Objects (GPOs) to set Notepad as the default application for opening JS files
3. Monitor (search volumetrically) search-engine-optimized (SEO) Traffic to Filesharing Sites
4. Analyze how a ZIP file appears to a Sandbox Test Environment when opened.
Importance:
The recent Evolution of GootLoader has made it abundantly clear that Threat Actors are becoming more focused on making their Malware Compatible with end-users rather than penetration testing or forensics. The usage of trusted operating-system functionality and Automated Inspection Techniques can still be utilized as viable routes for Threat Actors to obtain initial access to their Ransomware operations.
Source: The Hacker News
