MITRE ATT&CKsoftware (malware)
S1046 PowGoop
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.0
- Created
- 2022-09-29
Description
PowGoop is a loader that consists of a DLL loader and a PowerShell-based downloader; it has been used by MuddyWater as their main loader.
Related
Uses · MITRE ATT&CK (8)
- T1573 Encrypted Channel technique
- T1071.001 Web Protocols sub-technique
- T1132.002 Non-Standard Encoding sub-technique
- T1574.001 DLL sub-technique
- T1059.001 PowerShell sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1036 Masquerading technique
Referenced by MITRE ATT&CK · uses (1)
- G0069 MuddyWater group
References
- https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/ CYBERCOM Iranian Intel Cyber January 2022
- https://www.cisa.gov/uscert/ncas/alerts/aa22-055a DHS CISA AA22-055A MuddyWater February 2022