Gootloader
Software · ATTACK:enterprise:S1138
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1138",
"title": "Gootloader",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1138",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--396c18b9-26fb-4435-8589-fb856502e4c4",
"external_id": "S1138",
"domain": "enterprise",
"created": "2024-05-28T20:39:16.453Z",
"modified": "2024-06-19T20:03:19.442Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "SentinelOne Gootloader June 2021",
"url": "https://www.sentinelone.com/labs/gootloader-initial-access-as-a-service-platform-expands-its-search-for-high-value-targets/"
},
{
"source_name": "Sophos Gootloader",
"url": "https://news.sophos.com/en-us/2021/03/01/gootloader-expands-its-payload-delivery-options/"
}
]
}Explicit source assertions (18)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02653ee2-6907-4fb5-b946-9cbd4377ad64
SentinelOne Gootloader June 2021ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1584.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2d5baa1d-8a54-4ce2-a983-3fd68e173cb4
SentinelOne Gootloader June 2021ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--311c74c3-5eda-4a55-9ac9-a51b518dcb7e
SentinelOne Gootloader June 2021ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1584.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c26f9f5-7aaf-4bb0-81ee-23b0e3a303cc
SentinelOne Gootloader June 2021ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--41bec3ae-de2b-470b-b356-dd163bd20445
Sophos GootloaderATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--54fad432-5890-4a82-b1c3-83c54ad773ff
SentinelOne Gootloader June 2021 · Sophos GootloaderATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1497.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--55a12a15-04fc-49b9-b268-245cb4559bcf
Sophos GootloaderATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1614.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5c12d816-bb1e-4f3b-8247-7a1780d2db01
Sophos GootloaderATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7a75776c-22e1-4227-9c7a-8531f9ce6c5e
SentinelOne Gootloader June 2021 · Sophos GootloaderATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7f4685df-335f-4c8a-900a-4018e52d92c3
Sophos GootloaderATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--81a70e7b-e4be-4856-9832-a893d4df2e1a
SentinelOne Gootloader June 2021 · Sophos GootloaderATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a322f31a-42e0-4314-9ea0-9e04037dc5ce
SentinelOne Gootloader June 2021 · Sophos GootloaderATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1055.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a487371e-15c9-405a-8774-0827fea2c3a3
Sophos GootloaderATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1055.012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--abf48d17-9624-4ea7-be2f-769711609eba
SentinelOne Gootloader June 2021 · Sophos GootloaderATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ade53a0c-965b-4d6a-bef1-aad302cf3cb3
SentinelOne Gootloader June 2021ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b1b17a6e-991a-4ead-aedd-c7b1f09ce17c
SentinelOne Gootloader June 2021ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d27bfd8a-f9f3-4dbf-86a2-b12ac9ea3de8
SentinelOne Gootloader June 2021 · Sophos GootloaderATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e44f4171-5601-4b92-964a-908af35b98e2
SentinelOne Gootloader June 2021 · Sophos Gootloader