S1138 Gootloader

malwareEnterprise

PlattformenWindows

auch bekannt alsGootloader

Gootloader is a Javascript-based infection framework that has been used since at least 2020 as a delivery method for the Gootkit banking trojan, Cobalt Strike, REvil, and others. Gootloader operates on an "Initial Access as a Service" model and has leveraged SEO Poisoning to provide access to entities in multiple sectors worldwide including financial, military, automotive, pharmaceutical, and energy.

genutzte Techniken (18)

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

T1016System Network Configuration Discovery
T1027Obfuscated Files or Information
T1055.002Portable Executable Injection
T1055.012Process Hollowing
T1059.001PowerShell
T1059.007JavaScript
T1069.002Domain Groups
T1082System Information Discovery
T1105Ingress Tool Transfer
T1132.001Standard Encoding
T1140Deobfuscate/Decode Files or Information
T1204.001Malicious Link
T1497.003Time Based Checks
T1547.001Registry Run Keys / Startup Folder
T1584.001Domains
T1584.006Web Services
T1614System Location Discovery
T1614.001System Language Discovery

Quelle

Wo diese Definition veröffentlicht ist.

auf ATT&CK ansehen

scry

Software wie diese trägt bekannte Schwachstellen, sobald sie im Internet exponiert ist. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan