GootLoader Malware Uses 500–1,000 Concatenated ZIP Archives to Evade Detection

The GootLoader malware campaign, active since at least 2020, has introduced a novel evasion technique that exploits the quirks of different ZIP file processing tools. Security researchers from Expel have observed the threat actors creating malformed ZIP archives that concatenate anywhere from 500 to 1,000 individual archives into a single file. This technique is specifically engineered to defeat automated security analysis while remaining perfectly functional for unsuspecting victims.

The Technical Evasion Mechanism

The core of this technique lies in how different unarchiving tools handle ZIP file structures. According to Expel security researcher Aaron Walton, the threat actors deliberately create archives with specific structural flaws:

1. Truncated End of Central Directory (EOCD): The archive's EOCD record is missing two critical bytes from its expected structure. This causes parsing errors in many third-party tools like WinRAR or 7-Zip, preventing automated workflows from analyzing the contents.

2. Randomized Field Values: Non-critical fields such as "disk number" and "Number of Disks" are randomized, causing unarchiving tools to expect a sequence of ZIP archives that don't actually exist.

3. Hashbusting: The random number of concatenated files and randomized field values create a unique ZIP file for each download. This "hashbusting" technique makes it nearly impossible for security tools to identify the threat using file hashes, as every sample is different.

The critical insight is that Windows' built-in unarchiver handles these malformed archives consistently and reliably. This creates a selective execution environment where automated security tools fail but the target system's native functionality works perfectly.

Attack Chain and Delivery

GootLoader typically spreads through search engine optimization (SEO) poisoning and malvertising campaigns. Users searching for legal templates or business documents are redirected to compromised WordPress sites hosting these malicious ZIP archives.

The delivery mechanism has also evolved. Recent campaigns leverage:

• Custom WOFF2 fonts with glyph substitution to obfuscate filenames
• WordPress comment endpoint exploitation (/wp-comments-post.php) to deliver ZIP payloads when users click "Download" buttons

The attack chain follows a precise sequence:

1. Client-side Assembly: The ZIP archive is delivered as an XOR-encoded blob. The victim's browser decodes and repeatedly appends this blob to itself until it reaches a predetermined size, bypassing network security controls designed to detect ZIP file transmission.

2. User Interaction: When the victim double-clicks the downloaded ZIP file, Windows' default unarchiver opens it in File Explorer. The JavaScript payload inside executes without explicit extraction, running via wscript.exe from a temporary folder.

3. Persistence Establishment: The JavaScript creates a Windows shortcut (LNK) file in the Startup folder, ensuring the malware survives system reboots.

4. Secondary Payload: A second JavaScript file executes using cscript, spawning PowerShell commands to collect system information and establish communication with a remote command-and-control server.

Why This Matters

This technique represents a significant evolution in malware delivery because it exploits the gap between different ZIP processing implementations. Most security tools rely on third-party libraries for file analysis, while end users typically use Windows' native functionality.

The technique also highlights how malware authors are increasingly targeting the "last mile" of security—the point where automated tools stop and human interaction begins. By ensuring their malware passes automated scans but executes perfectly on target systems, they increase their success rate while reducing detection.

Defensive Recommendations

Security teams should implement multiple layers of defense:

Endpoint Controls:

• Block execution of wscript.exe and cscript.exe for downloaded content unless explicitly required for business operations
• Use Group Policy Objects (GPO) to configure Windows to open JavaScript files in Notepad by default instead of executing them
• Implement application whitelisting to prevent unauthorized script execution

Network Controls:

• Monitor for unusual ZIP file downloads, particularly those with abnormal sizes or structures
• Analyze web traffic for patterns indicating SEO poisoning or malvertising campaigns
• Inspect downloaded files for concatenation patterns or structural anomalies

User Education:

• Train users to be suspicious of document templates or business files from search results
• Establish clear procedures for verifying the legitimacy of downloaded files before opening
• Encourage users to report suspicious file behavior immediately

Broader Implications

The GootLoader campaign illustrates a broader trend in malware development: the increasing sophistication of evasion techniques that exploit legitimate system functionality. Rather than relying solely on obfuscation or encryption, modern malware authors are studying how different software implementations handle edge cases and designing attacks that exploit those differences.

This approach is particularly effective because it targets the fundamental assumption that "if it opens on my machine, it's safe." The reality is that different software tools handle malformed files differently, and malware authors are learning to exploit those differences systematically.

For security professionals, this underscores the importance of defense-in-depth strategies that don't rely on any single detection method. Behavioral analysis, user education, and strict execution controls are all essential components of an effective defense against such targeted evasion techniques.

The Expel report serves as a reminder that malware campaigns are constantly evolving, and what works today may be obsolete tomorrow. Continuous monitoring, threat intelligence sharing, and adaptive security controls remain the most effective countermeasures against sophisticated threat actors.

---

Related Resources:

• Expel Security Research - For detailed threat intelligence reports
• Microsoft Security Documentation - Application control best practices
• CISA Alert AA22-103A - Defending against SEO poisoning attacks
• OWASP Secure Coding Practices - Script execution security guidelines