MITRE ATT&CKsoftware (malware)

S0477 Goopy

Published 2020-06-19 Modified 2025-04-16 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.1
Created
2020-06-19

Description

Goopy is a Windows backdoor and Trojan used by APT32 and shares several similarities to another backdoor used by the group (Denis). Goopy is named for its impersonation of the legitimate Google Updater executable.

Related

Uses · MITRE ATT&CK (18)

  • T1685 Disable or Modify Tools technique
  • T1027.016 Junk Code Insertion sub-technique
  • T1070.008 Clear Mailbox Data sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1071.003 Mail Protocols sub-technique
  • T1071.004 DNS sub-technique
  • T1574.001 DLL sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1059.005 Visual Basic sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1027.001 Binary Padding sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1005 Data from Local System technique
  • T1033 System Owner/User Discovery technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1057 Process Discovery technique
  • T1106 Native API technique

Referenced by MITRE ATT&CK · uses (1)

References