MITRE ATT&CKsoftware (malware)
S1168 SampleCheck5000
- Domain
- enterprise
- Platforms
- Windows
- Aliases
- SC5k
- Version
- 1.1
- Created
- 2024-11-25
Description
SampleCheck5000 is a downloader with multiple variants that was used by OilRig including during the Outer Space campaign to download and execute additional payloads.
Related
Uses · MITRE ATT&CK (10)
- T1680 Local Storage Discovery technique
- T1071.001 Web Protocols sub-technique
- T1102.002 Bidirectional Communication sub-technique
- T1074.001 Local Data Staging sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1567 Exfiltration Over Web Service technique
- T1560.001 Archive via Utility sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1082 System Information Discovery technique
- T1105 Ingress Tool Transfer technique
References
- https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/ ESET OilRig Downloaders DEC 2023
- https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/ ESET OilRig Campaigns Sep 2023