Gootloader’s malformed zip evasion shows where detection breaks

At a glance

What this is: This analysis shows how Gootloader uses malformed ZIP archives, JScript execution, and follow-on PowerShell activity to bypass common inspection and establish footholds.

Why it matters: It matters because identity-adjacent execution chains often begin with user-driven script handling, then move into privileged persistence paths that can expose both human sessions and downstream service credentials.

By the numbers:

• In past years, Gootloader made up 11% of all malware Expel saw bypassing other security tools.

👉 Read Expel’s analysis of Gootloader’s malformed ZIP delivery and detection opportunities

Context

Malformed archives are a governance problem as much as a file-format problem. When analysis tools fail open or fail to parse, attackers gain time to move from delivery to execution before detections can fire. In this case, the initial mechanism is not a novel exploit but deliberate abuse of packaging, script execution, and Windows default associations.

The identity angle is indirect but real. Script-based malware frequently relies on ordinary user context to cross the boundary into execution, then uses that foothold to reach persistence, lateral movement, and sometimes credential access. For IAM and security teams, the lesson is that endpoint controls, script policy, and privilege boundaries all participate in identity protection.

Key questions

Q: What breaks when malicious scripts are allowed to run from downloaded archives?

A: User-driven archive execution collapses the boundary between file inspection and code execution. Once a script launches from a ZIP or temporary folder, static analysis and traditional hash-based blocking are much less effective. The main failure is not the archive itself but the trust given to common Windows script associations and user context.

Q: Why do malformed archives complicate threat detection in practice?

A: They exploit differences between parsers, so one tool may reject the file while another, including the victim’s default handler, opens it. That creates inconsistent triage and gives attackers time to reach execution. Detection should focus on abnormal structure, parser failures, and the behaviour that follows extraction.

Q: How should security teams measure whether script controls are working?

A: Look for a sharp reduction in script-host launches from user download locations, especially temporary folders and startup-linked paths. If wscript.exe and cscript.exe are still routinely invoked from those locations, the control is not actually constraining execution. Telemetry should confirm both policy enforcement and reduced malicious process lineage.

Q: Who is accountable when a user session turns into malware execution?

A: Accountability is shared across endpoint, identity, and security operations teams because the failure sits at the boundary of user behaviour, script policy, and endpoint enforcement. Frameworks such as NIST SP 800-53 and the NIST Cybersecurity Framework both expect clear control ownership and monitoring over execution paths, not just incident response after the fact.

Technical breakdown

Why malformed ZIP archives defeat static inspection

ZIP parsers depend on consistent central directory records and end-of-central-directory fields. Gootloader abuses that dependency by concatenating many ZIP structures, truncating required bytes, and randomising non-critical metadata so that one parser may fail while Windows still opens the file. That creates a split between analyst tooling and victim execution. Static hashes also lose value because each delivered archive is unique, which weakens signature-based blocking and sample triage.

Practical implication: detect the archive’s structure and extraction behaviour, not just its hash or filename.

How JScript in a ZIP becomes an execution bridge

The first successful user interaction typically opens a ZIP, exposes a JScript file, and relies on the Windows default association to launch WScript. From there, the script can spawn PowerShell and stage additional actions. The key architectural issue is that the archive is only a delivery container. Once the script runs from a temporary location, the process lineage becomes the real indicator of compromise, especially when script execution originates from user context rather than an admin workflow.

Practical implication: restrict or reassign script associations and monitor for script execution from temporary directories.

Why startup-folder persistence and shortnames matter

After initial execution, the malware creates a persistence chain using .LNK files in the Startup folder and hides follow-on execution through NTFS shortnames. That combination is effective because it leans on normal Windows features that many environments rarely monitor closely. The process genealogy matters too: CScript launching PowerShell from unusual script paths is a much stronger signal than the file contents alone. This is a classic example of abusing benign platform behaviour to obscure malicious intent.

Practical implication: alert on startup-folder link creation, legacy shortname script execution, and CScript-to-PowerShell lineage.

Threat narrative

Attacker objective: The objective is to create a low-noise initial foothold that survives basic inspection and hands execution to later-stage malware operators.

1. Entry begins when the victim downloads a malformed ZIP archive that is designed to evade many analysis tools while still opening in Windows Explorer.
2. Credential access is not the main mechanic here, but the malware gains execution through user context and can then hand off to PowerShell-based stages that prepare broader compromise.
3. Impact follows when the malware establishes persistence and enables the wider ransomware access chain associated with the actor ecosystem.

NHI Mgmt Group analysis

Malformed delivery is a control-evasion pattern, not a file-format curiosity. Gootloader shows that attackers can weaponise parser differences to break static analysis while preserving victim execution. That means control design has to account for how software interprets content, not just whether the content is malicious. Practitioners should treat archive parsing failure as a signal in its own right, not an exception to be ignored.

Script execution policy is still one of the highest-value containment controls. The attack depends on Windows users being able to turn a downloaded script into execution with minimal friction. That makes file association control, script host restriction, and behavioural monitoring far more relevant than signature confidence. Teams that allow legacy script paths without explicit business justification are keeping an avoidable foothold open.

Persistence through ordinary Windows features creates a detection blind spot. Startup-folder links and NTFS shortnames are not exotic on their own, but they become high-signal when they appear in a script-driven chain. This is the kind of cross-control abuse that slips past siloed monitoring. The practical conclusion is that endpoint telemetry, script policy, and execution lineage must be analysed together.

Identity governance is implicated through the user context that launches the malware. The initial compromise is not a privileged login event, but it still rides on a real user session and can escalate into access to credentials, tokens, or adjacent systems. That is why human identity controls, endpoint restrictions, and least-privilege boundaries must be evaluated as a single system. Security teams should assume that an ordinary user session can become an access broker for later-stage operators.

What this signals

Archive-based malware remains a policy problem, not just a malware problem. When users can still execute scripts from downloaded content, the control gap sits in execution policy, not detection volume. Teams should expect more abuse of default handlers, temporary folders, and shortcut-based persistence until script governance is tightened.

Behaviour-based detection around process genealogy will age better than file signatures for this class of threat. Monitoring for patterns such as archive extraction, script launch, and PowerShell handoff aligns well with NIST Cybersecurity Framework detect and respond expectations and reduces reliance on static file reputation.

Execution lineage is the named concept here: the chain from download to script host to PowerShell to persistence is what defenders should hunt, because each step validates the one before it. That lens helps security teams prioritise telemetry and policy changes that break the chain early rather than waiting for ransomware-stage escalation.

For practitioners

• Reassociate JScript files away from execution Use GPO to set .js and .jse files to open in Notepad rather than WScript so double-clicking a script does not execute it. This removes the easiest user-driven execution path without breaking the file type entirely.
• Block script hosts from downloaded content Restrict wscript.exe and cscript.exe from running downloaded files, and consider limiting them entirely where business use is not required. Pair this with software restriction policies that reduce script-based footholds.
• Detect archive anomalies before extraction Monitor for malformed ZIP structures, repeated concatenated archives, and extraction failures that differ from Windows Explorer behaviour. Add triage logic for files that parse inconsistently across tools rather than trusting a single scanner.
• Alert on the malicious process genealogy Create detections for wscript.exe launching a .js file from AppData\Local\Temp, CScript executing NTFS shortnames, and CScript spawning PowerShell. This process chain is more durable than any single file signature.

Key takeaways

• Gootloader’s malformed ZIP delivery shows how attackers can turn parser differences and default Windows behaviour into a reliable initial-access path.
• The strongest evidence here is behavioural, not hash-based, because each archive is unique and the malware’s early-stage purpose is to evade static inspection.
• Controlling script execution from user contexts, especially downloaded archives and temporary folders, would reduce the attack’s practical value far more than chasing individual samples.

Key terms

• Malformed ZIP archive: A ZIP file deliberately constructed so that common parsers misread or reject it while the target operating system can still open it. Attackers use malformed fields, truncated metadata, and unusual structure to frustrate static analysis and speed up malicious execution.
• Hashbusting: A technique that changes a file’s observable properties so each delivered sample has a different hash or fingerprint. In malware delivery, this reduces the value of signature matching and sample correlation, forcing defenders to rely on behaviour and structure instead of exact file identity.
• Process genealogy: The parent-child execution chain that shows how one process led to another on an endpoint. It is a high-value detection signal because malware often blends in as individual binaries, while the sequence of script hosts, interpreters, and shells exposes the malicious workflow.
• Startup-folder persistence: A persistence method that places a shortcut or executable in a user’s Startup folder so it runs automatically at logon. It is effective because it uses a normal Windows feature, which means defenders need telemetry on file creation, path location, and the process that created it.

What's in the full article

Expel's full article covers the operational detail this post intentionally leaves for the source:

• Hex-level comparison of well-formed versus malformed ZIP structures, including the exact bytes that confuse common tooling
• Detection logic for archive anomalies that distinguish Gootloader samples from normal ZIP files
• Process-tree examples showing how WScript, CScript, and PowerShell chain together during execution
• Detailed discussion of the startup-folder and NTFS shortname persistence mechanics

👉 The full Expel article covers the ZIP structure details, process genealogy, and detection methods in depth

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, and secrets management for practitioners who need to connect access control with operational risk. It helps security and identity teams build the governance habits that reduce hidden exposure across human and non-human estates.