ESET OilRig Downloaders DEC 2023

OilBooster can use a backup channel to request a new refresh token from its C2 server after 10 consecutive unsuccessful connections to the primary OneDrive C2 server.

OilBooster can identify the compromised system's username which is then used as part of a unique identifier.

OilBooster can use an actor-controlled OneDrive account for C2 communication and exfiltration.

ODAgent can use an attacker-controlled OneDrive account to receive C2 commands and to exfiltrate files.

OilBooster has the ability to execute shell commands and exfiltrate the results.

SampleCheck5000 can call cmd.exe to execute C2 command line strings.

ODAgent can execute a specified command line passed via API.

ODAgent can delete payloads and files used to pass C2 commands from remotely hosted cloud accounts.

OilBooster can send HTTP `GET`, `POST`, `PUT`, and `DELETE` requests to the Microsoft Graph API over port 443 for C2 communication.

SampleCheck5000 can use the Exchange Web Services API for C2 communication.

SampleCheck5000 can log the output from C2 commands in an encrypted and compressed format on disk prior to exfiltration.

OilBooster can stage files in the `tempFiles` directory for exfiltration.

OilBooster can identify the compromised system's hostname which is used to create a unique identifier.

SampleCheck5000 can create unique victim identifiers by using the compromised system’s computer name.

ODAgent can identify the current working directory.

SampleCheck5000 can use the Microsoft Office Exchange Web Services API to access an actor-controlled account and retrieve C2 commands and payloads placed in Draft messages.

OilCheck can use a REST-based Microsoft Graph API to access draft messages in a shared Microsoft Office 365 Outlook email account used for C2 communication.

ODAgent can use the Microsoft Graph API to access an attacker-controlled OneDrive account and retrieve payloads and backdoor commands.

OilBooster uses the Microsoft Graph API to connect to an actor-controlled OneDrive account to download and execute files and shell commands, and to create directories to share exfiltrated data.

OilBooster can download and execute files from an actor-controlled OneDrive account.

ODAgent has the ability to download and execute files on compromised systems.

SampleCheck5000 can download additional payloads to compromised hosts.

OilCheck can download staged payloads from an actor-controlled infrastructure.

ODAgent can pass commands using native APIs.

OilBooster has used the `ShowWindow` and `CreateProcessW` APIs.

OilBooster can Base64-decode and XOR-decrypt C2 commands taken from JSON files.

ODAgent can Base64-decode and XOR decrypt received C2 commands.

SampleCheck5000 can decode and decrypt command line strings and files received through C2.

OilBooster can read the results of command line execution via an unnamed pipe connected to the process.

SampleCheck5000 can gzip compress files uploaded to a shared mailbox used for C2 and exfiltration.

OilBooster can hide its console window upon execution through the `ShowWindow` API.

SampleCheck5000 can use the Microsoft Office Exchange Web Services API to access an actor-controlled account and retrieve files for exfiltration.

OilCheck can upload documents from compromised hosts to a shared Microsoft Office 365 Outlook email account for exfiltration.

ODAgent can use an attacker-controlled OneDrive account for exfiltration.

OilBooster can exfiltrate files to an actor-controlled OneDrive account via the Microsoft Graph API.

OilBooster can use the OpenSSL library to encrypt C2 communications.

OilRig actively developed and used a series of downloaders during 2022.

SampleCheck5000 can create unique victim identifiers by using the compromised system’s volume ID.