Are GootLoader malware procedures mitigated on this host?
Tactic: Execution
CISA released an advisory in August 2022 on GootLoader, a malware loader. This TTP uses GootLoader's methods of downloading a JScript file within a Zip file, using Wscript to execute the JS file to add specific registry keys, reflectively loading a non-existent DLL, and creating a scheduled task for persistence. GootLoader may deploy Cobalt Strike Beacons, deploy banking Trojans, and even ransomware.
View Command
To view this TTPs command, you must be logged in with a professional or enterprise license.
LoginTest this TTP
Download Operator (1.7.1)
Test this TTP using one of our Operator chainsEmulates tactics found in GootLoader malware.
Are GootLoader malware procedures mitigated on this host?
2022-08-30
Follow @preludeorg on Twitter for new chains and more.
Join the Prelude Discord to discuss chains and more.
Keep up to date with code changes and community activity on Github