A DNS Investigation of the GootLoader Campaign
It’s one thing for a piece of malware to steal victims’ data. It gets worse, though, when that malware paves the way for even more sinister actions like dropping a ransomware or allowing further compromise without getting detected. That’s the case for GootLoader.1
Twelve domains have been tagged as GootLoader indicators of compromise (IoCs).2 The WhoisXML API expanded this list to uncover other connected artifacts and found:
- 33 email-connected domains
- 15 IP addresses, six of which turned out to be malicious
- 692 IP-connected domains
- 302 string-connected domains
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.
—
- [1] https://news.sophos.com/en-us/2024/11/06/bengal-cat-lovers-in-australia-get-psspsspssd-in-google-driven-gootloader-campaign/
- [2] https://github.com/sophoslabs/IoCs/blob/master/gootloader_cats_iocs.csv
Latest Reports
Earth Sirrush Espionage Tool Evolution: DNS Facts Unveiled
WhoisXML API uncovered 400+ additional artifacts linked to Earth Sirrush. Download the threat research materials now.
Four hours before PHP2Shell’s Disclosure
A server scouted our honeypots 4 hours before PHP2Shell’s disclosure, then returned with exploit attempts. The report covers its traffic history and IoCs.
APT36 Deploys Multiple Malware in RapidRust: A DNS Investigation
WhoisXML API uncovered 300+ additional artifacts linked to Operation RapidRust. Download the threat research materials now.