Palo Alto OilRig May 2016

OilRig has used sc query on a victim to gather information about services.

OilRig has used reg query “HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default” on a victim to query the Registry.

OilRig has run ipconfig /all on a victim.

The Helminth config file is encrypted with RC4.

Helminth splits data into chunks up to 23 bytes and sends the data in DNS queries to its C2 server.

OilRig has run whoami on a victim.

OilRig has used netstat -an on a victim to get a listing of network connections.

The executable version of Helminth has a module to log keystrokes.

OilRig has run tasklist on a victim's machine and used infostealers to capture processes.

One version of Helminth uses a PowerShell script.

Helminth can provide a remote shell. One version of Helminth uses batch scripting.

One version of Helminth consists of VBScript scripts.

OilRig has used net localgroup administrators to find local administrators on compromised systems.

OilRig has used net group /domain, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to find domain group permission settings.

Helminth can use HTTP for C2.

Helminth can use DNS for C2.

Helminth creates folders to store output from batch scripts prior to sending the information to its C2 server.

OilRig has run hostname and systeminfo on a victim.

OilRig has run net user, net user /domain, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to get account listings on a victim.

OilRig has run net user, net user /domain, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to get account listings on a victim.

Helminth can download additional files.

The executable version of Helminth has a module to log clipboard contents.

A Helminth VBScript receives a batch script to execute a set of commands in a command prompt.

For C2 over HTTP, Helminth encodes data with base64 and sends it via the "Cookie" field of HTTP requests. For C2 over DNS, Helminth converts ASCII characters into their hexadecimal values and sends the data in cleartext.

OilRig has used a CHM payload to load and execute another malicious file once delivered to a victim.

Helminth establishes persistence by creating a shortcut in the Start Menu folder.

Helminth establishes persistence by creating a shortcut.

Helminth encrypts data sent to its C2 server over HTTP with RC4.