S1172 OilBooster

malwareEnterprise

platformsWindows

also known asOilBooster

OilBooster is a downloader written in Microsoft Visual C/C++ that has been used by OilRig since at least 2022 including against target organizations in Israel to download and execute files and for exfiltration.

techniques used (15)

ATT&CK techniques this enables or maps to.

T1008Fallback Channels
T1033System Owner/User Discovery
T1041Exfiltration Over C2 Channel
T1059.003Windows Command Shell
T1071.001Web Protocols
T1074.001Local Data Staging
T1082System Information Discovery
T1102.002Bidirectional Communication
T1105Ingress Tool Transfer
T1106Native API
T1140Deobfuscate/Decode Files or Information
T1559Inter-Process Communication
T1564.003Hidden Window
T1567.002Exfiltration to Cloud Storage
T1573.002Asymmetric Cryptography

used by groups (1)

Threat groups associated with this.

G0049OilRig

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan