GootLoader uses malformed ZIP files to bypass security controls

GootLoader is described as malware used by ransomware actors for initial access and then handed off to others, with its loader built to evade detection. The article notes that the ZIP it spreads in is made of hundreds of concatenated archives, specifically 500–1,000 ZIP archives glued together, and that ZIPs are read from the end, allowing the file to function while evading many tools.

Windows can open the archive, while many unarchiving tools cannot, enabling the actor to bypass analysis and rely on behaviour-based detection rather than file signatures. The initial delivery involves an encoded file that is decoded in the browser, downloads into a ZIP that Windows then presents as a JavaScript file, and, once opened, the malware launches, creates a startup shortcut for persistence, and uses PowerShell to continue the attack.

The report, according to Expel, describes the archive as an anti-analysis technique where the default Windows unarchiver remains able to access the contents. Detection guidance emphasises monitoring abnormal ZIP behaviour, script execution from temp folders, and particular process chains such as cscript launching PowerShell.