S1168 SampleCheck5000

malwareEnterprise

platformsWindows

also known asSampleCheck5000 · SC5k

SampleCheck5000 is a downloader with multiple variants that was used by OilRig including during the Outer Space campaign to download and execute additional payloads.

techniques used (10)

ATT&CK techniques this enables or maps to.

T1059.003Windows Command Shell
T1071.001Web Protocols
T1074.001Local Data Staging
T1082System Information Discovery
T1102.002Bidirectional Communication
T1105Ingress Tool Transfer
T1140Deobfuscate/Decode Files or Information
T1560.001Archive via Utility
T1567Exfiltration Over Web Service
T1680Local Storage Discovery

used by groups (1)

Threat groups associated with this.

G0049OilRig

used by campaigns (1)

Campaigns that use this.

C0042Outer Space

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan