Procedure examples

Goopy has the ability to exfiltrate documents from infected systems.

Goopy has had null characters padded in its malicious DLL payload.

Goopy's decrypter have been inflated with junk code in between legitimate API functions, and also included infinite loops to avoid analysis.

Goopy has the ability to enumerate the infected system's user name.

Goopy has impersonated the legitimate goopdate.dll, which was dropped on the target system with a legitimate GoogleUpdate.exe.

Goopy has the ability to exfiltrate data over the Microsoft Outlook C2 channel.

Goopy has the ability to maintain persistence by creating scheduled tasks set to run every hour.

Goopy has checked for the Google Updater process to ensure Goopy was loaded properly.

Goopy has the ability to use cmd.exe to execute commands passed from an Outlook C2 channel.

Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.

Goopy has the ability to delete emails used for C2 once the content has been copied.

Goopy has the ability to communicate with its C2 over HTTP.

Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.

Goopy has the ability to communicate with its C2 over DNS.

Goopy has the ability to enumerate the infected system's user name via GetUserNameW.

Goopy has used a polymorphic decryptor to decrypt itself at runtime.

Goopy has the ability to side-load malicious DLLs with legitimate applications from Kaspersky, Microsoft, and Google.

Goopy has the ability to disable Microsoft Outlook's security policies to disable macro warnings.