ESET OilRig Campaigns Sep 2023

Solar can automatically exfitrate files from compromised systems.

During Outer Space, OilRig deployed VBS droppers with obfuscated strings.

Mango contains a series of base64 encoded substrings.

Mango can collect the user name from a compromised system which is used to create a unique victim identifier.

Mango can use its HTTP C2 channel for exfiltration.

Solar can send staged files to C2 for exfiltration.

Mango can create a scheduled task to run every 32 seconds to communicate with C2 and execute received commands.

During Juicy Mix, OilRig used VBS droppers to schedule tasks for persistence.

Solar can create scheduled tasks named Earth and Venus, which run every 30 and 40 seconds respectively, to support C2 and exfiltration.

During Juicy Mix, OilRig used a PowerShell script to steal credentials.

SampleCheck5000 can call cmd.exe to execute C2 command line strings.

During Juicy Mix, OilRig used VBS droppers to deliver and establish persistence for the Mango backdoor.

During Outer Space, OilRig used VBS droppers to deploy malware.

Solar has the ability to delete staged files after they are uploaded to C2.

During Juicy Mix, OilRig used a VBS script to send POST requests to register installed malware with C2.

During Outer Space, OilRig used HTTP to communicate between installed backdoors and compromised servers including via the Microsoft Exchange Web Services API.

Mango can retrieve C2 commands sent in HTTP responses.

During Juicy Mix, OilRig used browser data and credential stealer tools to stage stolen files named Cupdate, Eupdate, and IUpdate in the %TEMP% directory.

Solar can send basic information about the infected host to C2.

Mango can collect the machine name of a compromised system which is later used as part of a unique victim identifier.

During Juicy Mix, OilRig used a script to send the name of the compromised host via HTTP `POST` to register it with C2.

Mango can enumerate the contents of current working or other specified directories.

SampleCheck5000 can use the Microsoft Office Exchange Web Services API to access an actor-controlled account and retrieve C2 commands and payloads placed in Draft messages.

Solar has the ability to download and execute files.

During Outer Space, OilRig downloaded additional tools to comrpomised infrastructure.

SampleCheck5000 can download additional payloads to compromised hosts.

Mango has the ability to use Native APIs.

During Juicy Mix, OilRig used a VBS script to send the Base64-encoded name of the compromised computer to C2.

Mango can receive Base64-encoded commands from C2.

Solar can Base64-encode and gzip compress C2 communications including command outputs.

SampleCheck5000 can decode and decrypt command line strings and files received through C2.

During Juicy Mix, OilRig used a script to concatenate and deobfuscate encoded strings in Mango.

Mango has been executed through a Microsoft Word document with a malicious macro.

During Outer Space, OilRig used a Chrome data dumper named MKG.

During Juicy Mix, OilRig used the CDumper (Chrome browser) and EDumper (Edge browser) data stealers to collect cookies, browsing history, and credentials.

During Juicy Mix, OilRig used browser data dumper tools to create a list of users with Google Chrome installed.

During Juicy Mix, OilRig used the CDumper (Chrome browser) and EDumper (Edge browser) to collect credentials.

During Juicy Mix, OilRig used a Windows Credential Manager stealer for credential access.

SampleCheck5000 can use the Microsoft Office Exchange Web Services API to access an actor-controlled account and retrieve files for exfiltration.

Mango can receive XOR-encrypted commands from C2.

Solar can XOR encrypt C2 communications.

Mango can use TLS to encrypt C2 communications.

During Juicy Mix, OilRig compromised an Israeli job portal to use for a C2 server.

During Outer Space, OilRig compromised an Israeli human resources site to use as a C2 server.

During Outer Space, OilRig created M365 email accounts to be used as part of C2.

For Outer Space, OilRig created new implants including the Solar backdoor.

For Juicy Mix, OilRig improved on Solar by developing the Mango backdoor.

Mango contains an unused capability to block endpoint security solutions from loading user-mode code hooks via a DLL in a specified process by using the `UpdateProcThreadAttribute API` to set the `PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY` to `PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON` for an identified process.