Procedure examples

OopsIE uses the Confuser protector to obfuscate an embedded .Net Framework assembly used for C2. OopsIE also encodes collected data in hexadecimal format before writing to files on disk and obfuscates strings.

OopsIE uses the SmartAssembly obfuscator to pack an embedded .Net Framework assembly used for C2.

OopsIE exfiltrates command output and collected files to its C2 server in 1500-byte blocks.

OopsIE can upload files from the victim's machine to its C2 server.

OopsIE uses WMI to perform discovery techniques.

OopsIE creates a scheduled task to run itself every three minutes.

OopsIE uses the command prompt to execute commands on the victim's machine.

OopsIE creates and uses a VBScript as part of its persistent execution.

OopsIE has the capability to delete files and scripts from the victim's machine.

OopsIE uses HTTP for C2 communications.

OopsIE stages the output from command execution and collected files in specific folders before exfiltration.

OopsIE checks for information on the CPU fan, temperature, mouse, hard disk, and motherboard as part of its anti-VM checks.

OopsIE can download files from its C2 server to the victim's machine.

OopsIE checks to see if the system is configured with "Daylight" time and checks for a specific region to be set for the timezone.

OopsIE encodes data in hexadecimal format over the C2 channel.

OopsIE concatenates then decompresses multiple resources to load an embedded .Net Framework assembly.

OopsIE performs several anti-VM and sandbox checks on the victim's machine. One technique the group has used was to perform a WMI query SELECT * FROM MSAcpi_ThermalZoneTemperature to check the temperature to see if it’s running in a virtual environment.

OopsIE compresses collected files with GZipStream before sending them to its C2 server.

OopsIE compresses collected files with a simple character replacement scheme before sending them to its C2 server.