S0477 Goopy

malwareEnterprise

platformsWindows

also known asGoopy

Goopy is a Windows backdoor and Trojan used by APT32 and shares several similarities to another backdoor used by the group (Denis). Goopy is named for its impersonation of the legitimate Google Updater executable.

techniques used (18)

ATT&CK techniques this enables or maps to.

T1005Data from Local System
T1027.001Binary Padding
T1027.016Junk Code Insertion
T1033System Owner/User Discovery
T1036.005Match Legitimate Resource Name or Location
T1041Exfiltration Over C2 Channel
T1053.005Scheduled Task
T1057Process Discovery
T1059.003Windows Command Shell
T1059.005Visual Basic
T1070.008Clear Mailbox Data
T1071.001Web Protocols
T1071.003Mail Protocols
T1071.004DNS
T1106Native API
T1140Deobfuscate/Decode Files or Information
T1574.001DLL
T1685Disable or Modify Tools

used by groups (1)

Threat groups associated with this.

G0050APT32

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan