Goofy Guineapig Backdoor IOC

title: Goofy Guineapig Backdoor IOC
id: f0bafe60-1240-4798-9e60-4364b97e6bad
status: test
description: Detects malicious indicators seen used by the Goofy Guineapig malware
references:
    - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-14
tags:
    - attack.execution
    - detection.emerging-threats
    - attack.stealth
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename:
            - 'C:\ProgramData\GoogleUpdate\config.dat'
            - 'C:\ProgramData\GoogleUpdate\GoogleUpdate.exe'
            - 'C:\ProgramData\GoogleUpdate\GoogleUpdate\tmp.bat'
            - 'C:\ProgramData\GoogleUpdate\goopdate.dll'
    condition: selection
falsepositives:
    - Unlikely
level: high