S1171 OilCheck

malwareEnterprise

platformsWindows

also known asOilCheck

OilCheck is a C#/.NET downloader that has been used by OilRig since at least 2022 including against targets in Israel. OilCheck uses draft messages created in a shared email account for C2 communication.

01

techniques used (3)

ATT&CK techniques this enables or maps to.

02

used by groups (1)

Threat groups associated with this.

03

source

Where this definition is published.

view on ATT&CK
scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan