Updated 2024-05-09-IOCs-from-GootLoader-activity.txt

PaloAltoNetworks · May 10, 2024 · dccee05 · dccee05
1 parent 3c2e293
commit dccee05
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/2024-05-09-IOCs-from-GootLoader-activity.txt b/2024-05-09-IOCs-from-GootLoader-activity.txt
@@ -1,5 +1,10 @@
 2024-05-09 (THURSDAY): GOOTLOADER ACTIVITY
 
+REFERENCES:
+
+- https://www.linkedin.com/posts/unit42_gootloader-unit42threatintel-timelythreatintel-activity-7194787295676313600-UylW
+- https://twitter.com/Unit42_Intel/status/1789021679634505978
+
 INFECTION CHAIN:
 
 - Google search on a topic leads to compromised site with fake forum post --> download zip -->
@@ -59,4 +64,4 @@ ASSOCIATED MALWARE:
 - File type: ASCII text, with very long lines (65536), with no line terminators
 - File location: C:\Users\[username]\AppData\Roaming\[existing directory]\Build Automation.js
 - File description: Persistent JavaScript file for GootLoader infection
-- Run method: wscript.exe [file]
+- Run method: wscript.exe [file]