Unit 42 OopsIE! Feb 2018

OopsIE uses the Confuser protector to obfuscate an embedded .Net Framework assembly used for C2. OopsIE also encodes collected data in hexadecimal format before writing to files on disk and obfuscates strings.

OopsIE uses the SmartAssembly obfuscator to pack an embedded .Net Framework assembly used for C2.

OopsIE exfiltrates command output and collected files to its C2 server in 1500-byte blocks.

OopsIE can upload files from the victim's machine to its C2 server.

OopsIE creates a scheduled task to run itself every three minutes.

OilRig has created scheduled tasks that run a VBScript to execute a payload on victim machines.

OilRig has used various types of scripting for execution.

OilRig has used macros to deliver malware such as QUADAGENT and OopsIE. OilRig has used batch scripts.

OopsIE uses the command prompt to execute commands on the victim's machine.

OopsIE creates and uses a VBScript as part of its persistent execution.

OilRig has deleted files associated with their payload after execution.

OopsIE uses HTTP for C2 communications.

OopsIE stages the output from command execution and collected files in specific folders before exfiltration.

OopsIE can download files from its C2 server to the victim's machine.

OopsIE encodes data in hexadecimal format over the C2 channel.

OopsIE concatenates then decompresses multiple resources to load an embedded .Net Framework assembly.

A OilRig macro has run a PowerShell command to decode file contents. OilRig has also used certutil to decode base64-encoded files on victims.

OilRig has delivered malicious links to achieve execution on the target system.

OilRig has delivered macro-enabled documents that required targets to click the "enable content" button to execute the payload on the system.

OopsIE compresses collected files with GZipStream before sending them to its C2 server.

OopsIE compresses collected files with a simple character replacement scheme before sending them to its C2 server.

OilRig has sent spearphising emails with malicious attachments to potential victims using compromised and/or spoofed email accounts.

OilRig has sent spearphising emails with malicious links to potential victims.