OilCheck

ID: S1171
Type: Malware
Platforms: Windows
Source: attack.mitre.org
MITRE last modified: 28 Nov 2024

OilCheck is a C#/.NET downloader that has been used by OilRig since at least 2022 including against targets in Israel. OilCheck uses draft messages created in a shared email account for C2 communication.^[1]

Techniques used (3)

T1102.002 Bidirectional Communication
T1105 Ingress Tool Transfer
T1567 Exfiltration Over Web Service

Groups using it (1)

G0049 OilRig

References

ESET OilRig Downloaders DEC 2023