Goopy

Malware & Tools · Goopy

· MalwareS0477 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

Goopy is a Windows backdoor and Trojan used by APT32 and shares several similarities to another backdoor used by the group (Denis). Goopy is named for its impersonation of the legitimate Google Updater executable.(Citation: Cybereason Cobalt Kitty 2017)

Tactic Coverage

stealth (6)execution (5)command and control (3)discovery (2)collection (1)exfiltration (1)persistence (1)privilege escalation (1)defense impairment (1)

Used By (1 groups)

G0050APT32SeaLotus, OceanLotus

Techniques (18)

T1005Data from Local System

collection

T1027.001Binary Padding

stealth

T1027.016Junk Code Insertion

stealth

T1033System Owner/User Discovery

discovery

T1036.005Match Legitimate Resource Name or Location

stealth

T1041Exfiltration Over C2 Channel

exfiltration

T1053.005Scheduled Task

References

https://attack.mitre.org/software/S0477 https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf