Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Dissecting Goot Loader With Node.js

Summary: Unit 42 researchers documented how GootLoader, a JavaScript-based loader first seen as Gootkit Loader in 2020 and still distributed through fake forum posts as of 2024, uses time-consuming while loops to delay its malicious code and evade sandbox analysis. In one sample, a loop counter initialized at 8242 had to reach 2597242 before the horseq7 function array pointed to the sleepy function, a delay that took over 10 minutes in the researchers' environment before execution reached the course83 function where the deobfuscated malicious code begins.

Key Takeaway: Sandboxes with limited computing resources can time out or give up before a sample like this one finishes its roughly 10-minute stall, so the malicious code in course83 never runs and the sample reads as benign. GootLoader can deliver other malware, including ransomware, which means a sandbox verdict of 'clean' on a stalled sample is the gap an operator is counting on.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related