--- title: GootLoader Malware Uses 500–1,000 Concatenated ZIP... description: GootLoader malware now uses malformed ZIP archives created by concatenating 500-1,000 archives to evade detection. The technique exploits differences in how... canonical: https://daily.dev/posts/gootloader-malware-uses-500-1-000-concatenated-zip-archives-to-evade-detection-gtlhymqcn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GootLoader Malware Uses 500–1,000 Concatenated ZIP Archives to Evade Detection | daily.dev og:description: GootLoader malware now uses malformed ZIP archives created by concatenating 500-1,000 archives to evade detection. The technique exploits differences in how... og:url: https://daily.dev/posts/gootloader-malware-uses-500-1-000-concatenated-zip-archives-to-evade-detection-gtlhymqcn og:image: https://api.daily.dev/og/posts/gTlhYMQCn.png og:image:alt: GootLoader Malware Uses 500–1,000 Concatenated ZIP Archives to Evade Detection og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GootLoader Malware Uses 500–1,000 Concatenated ZIP Archives to Evade Detection **[The Hacker News](https://daily.dev/sources/thn)** · 4 min read · 0 upvotes · 0 comments ## Summary GootLoader malware now uses malformed ZIP archives created by concatenating 500-1,000 archives to evade detection. The technique exploits differences in how archiving tools parse ZIP files: common tools like WinRAR and 7-Zip fail to extract them, blocking automated analysis, while Windows' default unarchiver works reliably, allowing victims to execute the JavaScript payload. The malware employs hashbusting by randomizing archive values and truncating critical bytes, ensuring each downloaded file has a unique hash. Organizations can defend against this threat by blocking wscript.exe and cscript.exe from executing downloaded content and configuring JavaScript files to open in Notepad by default. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Fake 7-Zip downloads are turning home PCs into proxy nodes](https://daily.dev/posts/fake-7-zip-downloads-are-turning-home-pcs-into-proxy-nodes-w1kz2e32x) · Hacker News · 3 upvotes · 0 comments - [Cracked Software and YouTube Videos Spread CountLoader and GachiLoader Malware](https://daily.dev/posts/cracked-software-and-youtube-videos-spread-countloader-and-gachiloader-malware-2hej9pmh9) · The Hacker News · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#javascript](https://daily.dev/tags/javascript), [#windows](https://daily.dev/tags/windows), [#malware](https://daily.dev/tags/malware), [#powershell](https://daily.dev/tags/powershell) [View this post on daily.dev](https://daily.dev/posts/gootloader-malware-uses-500-1-000-concatenated-zip-archives-to-evade-detection-gtlhymqcn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GootLoader Malware Uses 500–1,000 Concatenated ZIP Archives to Evade Detection","url":"https://daily.dev/posts/gootloader-malware-uses-500-1-000-concatenated-zip-archives-to-evade-detection-gtlhymqcn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/gootloader-malware-uses-500-1-000-concatenated-zip-archives-to-evade-detection-gtlhymqcn"},"datePublished":"2026-01-16T18:22:16.213Z","dateModified":"2026-01-16T18:22:39.637Z","description":"GootLoader malware now uses malformed ZIP archives created by concatenating 500-1,000 archives to evade detection. The technique exploits differences in how...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b7e72ded66c7acdd816cbd546c433857?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b7e72ded66c7acdd816cbd546c433857?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"The Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/thn","url":"https://daily.dev/sources/thn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/gootloader-malware-uses-500-1-000-concatenated-zip-archives-to-evade-detection-gtlhymqcn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,javascript,windows,malware,powershell","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Hacker News","item":"https://daily.dev/sources/thn"},{"@type":"ListItem","position":3,"name":"GootLoader Malware Uses 500–1,000 Concatenated ZIP Archives to Evade Detection"}]} ```