Scmagazine

Gootloader Malware Evades Detection with Malformed ZIP Archives

First seen 16 Jan 2026, 19:05 UTC • Cyberinsider

•43.9

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Gootloader, a malware loader used for initial access in ransomware attacks, employs a malformed ZIP archive to evade detection. This archive, which contains a JScript file, causes common unarchiving tools like 7zip and WinRAR to fail, while the default Windows utility can unpack it. This technique involves concatenating up to 1,000 archives to further complicate analysis.

Ask AI about this cluster

Answers cite the sources they use

How this analysis works

Attack Flow

13 entities, 11 inferred relationships (STIX 2.1).

Technique (5)

Malware
Ransomware
T1059.001 - PowerShell
T1059 - Command and Scripting Interpreter
T1547.001 - Startup Folder

Malware (1)

Gootloader

Affected Platform (1)

Windows

Tool (6)

7-Zip
CScript
PowerShell
Windows Script Host
WinRar
Wscript.exe

Relationships

Malware targets Windows
Ransomware targets Windows
T1059.001 - PowerShell targets Windows
T1059 - Command and Scripting Interpreter targets Windows
T1547.001 - Startup Folder targets Windows
Gootloader related to 7-Zip
Gootloader related to CScript
Gootloader related to PowerShell
Gootloader related to Windows Script Host
Gootloader related to WinRar
Gootloader related to Wscript.exe

Continue Reading

Widespread Abuse of ScreenConnect to Deploy AsyncRAT via Fake Installers Spearphishing Campaigns Exploit Malicious Links for User Execution GrayAlpha Threat Actor Uses MaskBat Loader for NetSupport RAT Deployments Gootloader Malware Resurgence Leads to Domain Controller Compromise Gootloader Malware Resurfaces with Advanced Evasion Techniques GootLoader Malware Resurfaces to Target WordPress Users with Font Hack

Gootloader Malware Evades Detection with Malformed ZIP Archives

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading