Skip to content

Gootloader

Software · ATTACK:enterprise:S1138

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S1138",
  "title": "Gootloader",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S1138",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--396c18b9-26fb-4435-8589-fb856502e4c4",
  "external_id": "S1138",
  "domain": "enterprise",
  "created": "2024-05-28T20:39:16.453Z",
  "modified": "2024-06-19T20:03:19.442Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "SentinelOne Gootloader June 2021",
      "url": "https://www.sentinelone.com/labs/gootloader-initial-access-as-a-service-platform-expands-its-search-for-high-value-targets/"
    },
    {
      "source_name": "Sophos Gootloader",
      "url": "https://news.sophos.com/en-us/2021/03/01/gootloader-expands-its-payload-delivery-options/"
    }
  ]
}

Explicit source assertions (18)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1614

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02653ee2-6907-4fb5-b946-9cbd4377ad64

SentinelOne Gootloader June 2021

ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1584.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d5baa1d-8a54-4ce2-a983-3fd68e173cb4

SentinelOne Gootloader June 2021

ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1069.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--311c74c3-5eda-4a55-9ac9-a51b518dcb7e

SentinelOne Gootloader June 2021

ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1584.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c26f9f5-7aaf-4bb0-81ee-23b0e3a303cc

SentinelOne Gootloader June 2021

ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41bec3ae-de2b-470b-b356-dd163bd20445

Sophos Gootloader

ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54fad432-5890-4a82-b1c3-83c54ad773ff

SentinelOne Gootloader June 2021 · Sophos Gootloader

ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55a12a15-04fc-49b9-b268-245cb4559bcf

Sophos Gootloader

ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c12d816-bb1e-4f3b-8247-7a1780d2db01

Sophos Gootloader

ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a75776c-22e1-4227-9c7a-8531f9ce6c5e

SentinelOne Gootloader June 2021 · Sophos Gootloader

ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7f4685df-335f-4c8a-900a-4018e52d92c3

Sophos Gootloader

ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--81a70e7b-e4be-4856-9832-a893d4df2e1a

SentinelOne Gootloader June 2021 · Sophos Gootloader

ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1059.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a322f31a-42e0-4314-9ea0-9e04037dc5ce

SentinelOne Gootloader June 2021 · Sophos Gootloader

ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1055.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a487371e-15c9-405a-8774-0827fea2c3a3

Sophos Gootloader

ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--abf48d17-9624-4ea7-be2f-769711609eba

SentinelOne Gootloader June 2021 · Sophos Gootloader

ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ade53a0c-965b-4d6a-bef1-aad302cf3cb3

SentinelOne Gootloader June 2021

ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b1b17a6e-991a-4ead-aedd-c7b1f09ce17c

SentinelOne Gootloader June 2021

ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d27bfd8a-f9f3-4dbf-86a2-b12ac9ea3de8

SentinelOne Gootloader June 2021 · Sophos Gootloader

ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e44f4171-5601-4b92-964a-908af35b98e2

SentinelOne Gootloader June 2021 · Sophos Gootloader

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.