Goofy Guineapig Backdoor File IOC

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

Detects the creation of specific files associated with the Goofy Guineapig malware, which attempts to impersonate Google Update components. The rule looks for 'config.dat', 'GoogleUpdate.exe', 'tmp.bat', and 'goopdate.dll' within the 'C:\ProgramData\GoogleUpdate\' directory.