Gootloader Takedown: 25,000 Infections, 100+ Servers Seized — Detection and Remediation Guide for Defenders

---
title: Gootloader - Wscript Spawning PowerShell
id: 3f8a2c41-7b9d-4e51-a6c2-9d1e5f8b3a07
status: experimental
description: Detects PowerShell spawned by Windows Script Host (wscript/cscript), a hallmark of Gootloader's staged JavaScript execution chain.
references:
  - https://securityaffairs.com/202997/cyber-crime/gootloader-malware-disrupted-after-infecting-25000-computers.html
  - https://attack.mitre.org/techniques/T1059/007/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.007
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\powershell_ise.exe'
      - '\pwsh.exe'
  condition: all of selection_*
falsepositives:
  - Rare legitimate admin scripts that invoke PowerShell from WSH wrappers
level: high
---
title: Gootloader - JavaScript Execution from User Directories
id: 8c1d4e62-3a5f-4b78-9c01-2e7a6d4f9b15
status: experimental
description: Detects wscript.exe or cscript.exe executing JavaScript files from Downloads, AppData, or Temp directories, consistent with Gootloader SEO-poisoned ZIP delivery.
references:
  - https://securityaffairs.com/202997/cyber-crime/gootloader-malware-disrupted-after-infecting-25000-computers.html
  - https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
  selection_path:
    CommandLine|contains:
      - '\Downloads\'
      - '\AppData\Roaming\'
      - '\AppData\Local\Temp\'
  selection_ext:
    CommandLine|contains:
      - '.js'
      - '.jse'
  condition: all of selection_*
falsepositives:
  - Some enterprise software installers run JS helpers from temp paths; tune per environment
level: high
---
title: Gootloader - Run Key Persistence Referencing Script Files
id: b5e7f1a3-6c28-4d94-a817-4f2c8e6b1d93
status: experimental
description: Detects registry Run/RunOnce key values pointing to .js, .jse, or .vbs files in user-writable paths, a Gootloader persistence pattern.
references:
  - https://securityaffairs.com/202997/cyber-crime/gootloader-malware-disrupted-after-infecting-25000-computers.html
  - https://attack.mitre.org/techniques/T1060/
  - https://attack.mitre.org/techniques/T1547/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains:
      - '\CurrentVersion\Run'
  selection_value:
    Details|contains:
      - '.js'
      - '.jse'
      - '.vbs'
      - 'wscript'
  selection_path:
    Details|contains:
      - '\AppData\'
      - '\Temp\'
      - '\Downloads\'
      - '\ProgramData\'
  condition: all of selection_*
falsepositives:
  - Rare; legitimate software almost never persists scripts from user-writable paths via Run keys
level: critical

// Gootloader hunt: WSH execution from user paths + wscript spawning PowerShell
let lookback = 90d;
let ScriptHosts = dynamic(["wscript.exe", "cscript.exe"]);
let UserPaths = dynamic(["\\Downloads\\", "\\AppData\\Roaming\\", "\\AppData\\Local\\Temp\\", "\\ProgramData\\"]);
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FileName in~ (ScriptHosts)
| where ProcessCommandLine has_any (UserPaths)
    and ProcessCommandLine has_any (".js", ".jse")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, ProcessId, InitiatingProcessFileName
| join kind=leftouter (
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where FileName in~ ("powershell.exe", "pwsh.exe")
    | project ChildTime=Timestamp, DeviceName, ChildCmd=ProcessCommandLine, InitiatingProcessId
) on DeviceName, $left.ProcessId == $right.InitiatingProcessId
| where ChildTime between (Timestamp .. Timestamp + 5m) or isempty(ChildTime)
| summarize by Timestamp, DeviceName, AccountName, ProcessCommandLine, ChildCmd
| sort by Timestamp desc

// Gootloader persistence: Run keys referencing script interpreters or script files
DeviceRegistryEvents
| where Timestamp > ago(90d)
| where RegistryKey has_any ("\\CurrentVersion\\Run", "\\CurrentVersion\\RunOnce")
| where RegistryValueData has_any ("wscript", "cscript", ".js", ".jse", ".vbs")
| where RegistryValueData has_any ("AppData", "ProgramData", "Temp", "Downloads")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueName, RegistryValueData
| sort by Timestamp desc

-- Gootloader hunt: live WSH processes with script args + Run-key script persistence
SELECT {
  SELECT Pid, Name, CommandLine, Username, CreateTime
  FROM pslist()
  WHERE Name =~ '(?i)wscript|cscript'
    AND CommandLine =~ '(?i)\.js|\.jse|appdata|downloads|temp'
} AS SuspiciousScriptHosts,
{
  SELECT Key.Path AS RunKey, ValueName, String(value=ValueData) AS ValueData
  FROM stat(filename='')
  WHERE FALSE
} AS Placeholder
FROM scope()

-- Gootloader persistence sweep: Run keys containing script interpreters
SELECT Mtime, Key.Path AS KeyPath, Name AS ValueName,
       Data.value AS ValueData
FROM foreach(row={
  SELECT FullPath FROM glob(globs='HKEY_USERS/*/Software/Microsoft/Windows/CurrentVersion/Run*')
}, query={
  SELECT Mtime, Key, Name, Data
  FROM read_reg_key(globs='HKEY_USERS/*/Software/Microsoft/Windows/CurrentVersion/Run*/*')
})
WHERE ValueData =~ '(?i)wscript|cscript|\.js|\.jse|\.vbs'
  AND ValueData =~ '(?i)appdata|programdata|temp|downloads'

# Gootloader triage and verification script - run elevated
$report = "$env:TEMP\gootloader_triage_$(Get-Date -Format 'yyyyMMdd_HHmmss').txt"
"=== Gootloader Triage Report - $env:COMPUTERNAME ===" | Out-File $report

# 1. Audit Run/RunOnce keys for script-based persistence
"`n[+] Run Key Persistence Entries:`n" | Out-File $report -Append
$runPaths = @(
  'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
  'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
  'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
  'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
  'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run'
)
foreach ($path in $runPaths) {
  if (Test-Path $path) {
    (Get-ItemProperty $path).PSObject.Properties |
      Where-Object { $_.Value -match '\.js|\.jse|\.vbs|wscript|cscript' -and $_.Name -notmatch '^PS' } |
      ForEach-Object { "$path :: $($_.Name) = $($_.Value)" | Out-File $report -Append }
  }
}

# 2. Find JavaScript files in user-writable staging paths (last 90 days)
"`n[+] Suspicious JS files in AppData/Temp/Downloads (last 90 days):`n" | Out-File $report -Append
$cutoff = (Get-Date).AddDays(-90)
Get-ChildItem -Path "$env:APPDATA","$env:LOCALAPPDATA\Temp","$env:USERPROFILE\Downloads","C:\ProgramData" `
  -Recurse -Include *.js,*.jse -ErrorAction SilentlyContinue |
  Where-Object { $_.LastWriteTime -gt $cutoff } |
  Select-Object FullName, Length, LastWriteTime |
  Out-File $report -Append

# 3. Scheduled tasks invoking script interpreters or scripts
"`n[+] Scheduled tasks referencing scripts:`n" | Out-File $report -Append
Get-ScheduledTask | ForEach-Object {
  $actions = $_.Actions | Out-String
  if ($actions -match 'wscript|cscript|powershell.*\.js|\.jse') {
    "$($_.TaskPath)$($_.TaskName) :: $actions" | Out-File $report -Append
  }
}

# 4. Verify script-host hardening status (recommended: disable WSH for standard users via GPO)
"`n[+] WSH status (0 = disabled, recommended for non-admin endpoints):`n" | Out-File $report -Append
$wsh = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings' -Name Enabled -ErrorAction SilentlyContinue
if ($wsh) { "WSH Enabled = $($wsh.Enabled)" | Out-File $report -Append } else { "WSH setting not configured (default: enabled)" | Out-File $report -Append }

Write-Host "Triage complete. Report: $report"