BLOODHUNT MALWARE ARCHIVE
BLOODHUNT MALWARE SOFTWARE

Service-Disabled: In some cases, the Easy Anti-Cheat service might have either been disabled by the user or by optimization software.If the game has been installed through steam, the file integrity also needs to be verified. It is very important that all of the game files are verified by the Easy Anti-Cheat service before the game is launched. Game Verification: Sometimes, the game that you are trying to launch might have gotten corrupted or some of its files might be missing due to which the error is being triggered.This file only contains the launch data of a particular game at a particular time.

BLOODHUNT MALWARE SOFTWARE

Sys File: Sometimes the sys file located inside the main folder where Easy Anti-cheat has been installed might be preventing the software from being able to create another file due to which the error is being triggered.

One hypothesis as to why we observe Gootkit so frequently is that it is downloaded from sites victims navigated to based on search results they initiated themselves, as we further discuss in the user-initiated initial access section. Accordingly, Gootkit remains a threat to all organizations. Given the volume of Gootkit detections and the range of victims, this threat is likely more opportunistic than targeted to a specific industry or organization. Victims were likely directed to these sites after initiating queries in common search engines with keywords such as “agreement,” “contract,” and the names of various financial institutions. While we’ve observed Gootkit detections in customer environments across multiple sectors, almost without exception, infections occurred after victims visited compromised websites purporting to host content related to legal or financial agreements. We have also observed Gootkit dropping the Osiris banking trojan.

Based on public research and follow-on activity observed in customer environments last year, it’s likely that Gootkit operators facilitate ransomware-as-a-service (RaaS) activity in some cases, either deploying other payloads directly or selling access to environments with Gootkit infections. Though we didn’t observe any ransomware in that intrusion, the intrusion chain mirrored public reporting of compromises where victims’ networks were ultimately encrypted with Sodinokibi (REvil) ransomware. In 2021, Red Canary saw operators use Gootkit to deliver Cobalt Strike. While some researchers track the delivery mechanism as “Gootloader” and the trojan activity as “Gootkit,” Red Canary tracks both components as “Gootkit.” Our classification may shift as we gather additional information.įollow-on activity varies.

BLOODHUNT MALWARE ARCHIVE

Upon visiting a compromised website, victims are prompted to download a ZIP archive containing a malicious JavaScript file, which if executed can allow an adversary to remotely access a victim’s system.

Specifically, operators alter search engine results to direct victims to legitimate but compromised websites hosting Gootkit. Gootkit was originally delivered via spam email campaigns and older exploit kits, but over time its initial access has shifted to SEO poisoning tactics.

Over the past several years, it has evolved into a multi-stage tool used to facilitate a range of hands-on-keyboard activity in multi-pronged attacks, wherein more than one objective is likely accomplished. A malware threat with a JavaScript loader component, Gootkit has been actively observed in the wild for more than a decade.

Bloodhunt malware