Scmagazine

Gootloader Malware Evades Detection with Malformed ZIP Archives

First seen 16 Jan 2026, 19:05 UTC • Cyberinsider

•84% similarity •43.9

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Gootloader, a malware loader used for initial access in ransomware attacks, employs a malformed ZIP archive to evade detection. This archive, which contains a JScript file, causes common unarchiving tools like 7zip and WinRAR to fail, while the default Windows utility can unpack it. This technique involves concatenating up to 1,000 archives to further complicate analysis.

ThreatCluster AI

Attack Flow

13 entities, 11 inferred relationships (STIX 2.1).

Technique (5)

Malware
Ransomware
T1059.001 - PowerShell
T1059 - Command and Scripting Interpreter
T1547.001 - Startup Folder

Malware (1)

Gootloader

Affected Platform (1)

Windows

Tool (6)

7-Zip
CScript
PowerShell
Windows Script Host
WinRar
Wscript.exe

Relationships

Malware targets Windows
Ransomware targets Windows
T1059.001 - PowerShell targets Windows
T1059 - Command and Scripting Interpreter targets Windows
T1547.001 - Startup Folder targets Windows
Gootloader related to 7-Zip
Gootloader related to CScript
Gootloader related to PowerShell
Gootloader related to Windows Script Host
Gootloader related to WinRar
Gootloader related to Wscript.exe

Community

Browse all →

Gootloader Malware Evades Detection with Malformed ZIP Archives

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading