S1138 Gootloader

malwareEnterprise

platformsWindows

also known asGootloader

Gootloader is a Javascript-based infection framework that has been used since at least 2020 as a delivery method for the Gootkit banking trojan, Cobalt Strike, REvil, and others. Gootloader operates on an "Initial Access as a Service" model and has leveraged SEO Poisoning to provide access to entities in multiple sectors worldwide including financial, military, automotive, pharmaceutical, and energy.

techniques used (18)

ATT&CK techniques this enables or maps to.

T1016System Network Configuration Discovery
T1027Obfuscated Files or Information
T1055.002Portable Executable Injection
T1055.012Process Hollowing
T1059.001PowerShell
T1059.007JavaScript
T1069.002Domain Groups
T1082System Information Discovery
T1105Ingress Tool Transfer
T1132.001Standard Encoding
T1140Deobfuscate/Decode Files or Information
T1204.001Malicious Link
T1497.003Time Based Checks
T1547.001Registry Run Keys / Startup Folder
T1584.001Domains
T1584.006Web Services
T1614System Location Discovery
T1614.001System Language Discovery

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan