ESET researchers analyzed a rising collection of OilRig downloaders that the group has utilized in a number of campaigns all through 2022, to keep up entry to focus on organizations of particular curiosity – all positioned in Israel. These light-weight downloaders, which we named SampleCheck5000 (SC5k v1-v3), OilCheck, ODAgent, and OilBooster, are notable for utilizing one among a number of reputable cloud service APIs for C&C communication and information exfiltration: the Microsoft Graph OneDrive or Outlook APIs, and the Microsoft Workplace Change Internet Companies (EWS) API.

In all circumstances, the downloaders use a shared (electronic mail or cloud storage) OilRig-operated account to trade messages with the OilRig operators; the identical account is usually shared by a number of victims. The downloaders entry this account to obtain instructions and extra payloads staged by the operators, and to add command output and staged recordsdata.

We found the earliest of the collection, SC5k (v1) downloader, in November 2021, when it was utilized in OilRig’s Outer Area marketing campaign, documented in our current blogpost. Within the present blogpost, we give attention to the entire SC5k successors that OilRig developed all through 2022, with a brand new variation launched each few months; we may even take a better have a look at the mechanisms employed by these downloaders. We additionally examine these downloaders to different OilRig backdoors that use email-based C&C protocols, and that have been reported earlier this yr by Pattern Micro (MrPerfectionManager) and Symantec (PowerExchange).

Lastly, this blogpost additionally expands on our LABScon 2023 presentation, the place we drilled down into how OilRig retains entry to chose Israeli organizations: the entire downloaders studied on this blogpost have been deployed in networks that have been beforehand affected by a number of OilRig instruments, which underlines the truth that OilRig is persistent in concentrating on the identical organizations, and decided to maintain its foothold in compromised networks.

Key factors of this blogpost:

• OilRig actively developed and used a collection of downloaders with the same logic all through 2022: three new downloaders – ODAgent, OilCheck, OilBooster – and newer variations of the SC5k downloader.
• The downloaders use varied reputable cloud service APIs for C&C communication and information exfiltration: Microsoft Graph OneDrive API, Microsoft Graph Outlook API, and Microsoft Workplace EWS API.
• Targets, all in Israel, included a company within the healthcare sector, a producing firm, an area governmental group, and different organizations.
• All targets have been beforehand affected by a number of OilRig campaigns.

Attribution

OilRig, also referred to as APT34, Lyceum, Crambus, or Siamesekitten, is a cyberespionage group that has been lively since at the least 2014 and is generally believed to be primarily based in Iran. The group targets Center Japanese governments and quite a lot of enterprise verticals, together with chemical, vitality, monetary, and telecommunications.

OilRig carried out the DNSpionage marketing campaign in 2018 and 2019, which focused victims in Lebanon and the United Arab Emirates. In 2019 and 2020, OilRig continued its assaults with the HardPass marketing campaign, which used LinkedIn to focus on Center Japanese victims within the vitality and authorities sectors. In 2021, OilRig up to date its DanBot backdoor and commenced deploying the Shark, Milan, and Marlin backdoors, as talked about within the T3 2021 difficulty of the ESET Menace Report. In 2022 and 2023, the group carried out a number of assaults towards native authorities entities and healthcare organizations in Israel, utilizing its new backdoors Photo voltaic and Mango. In 2023, OilRig focused organizations within the Center East with the PowerExchange and MrPerfectionManager backdoors, and associated instruments to reap inside mailbox account credentials after which to leverage these accounts for exfiltration.

We attribute SC5k (v1-v3), ODAgent, OilCheck, and OilBooster downloaders to OilRig with a excessive degree of confidence, primarily based on these indicators:

• Targets:
  • These downloaders have been deployed completely towards Israeli organizations, which aligns with typical OilRig concentrating on.
  • The noticed verticals of the victims additionally align with OilRig’s pursuits – for instance, we’ve got seen OilRig beforehand concentrating on the Israeli healthcare sector, in addition to the native authorities sector in Israel.
• Code similarities:
  • The SC5k v2 and v3 downloaders developed naturally from the preliminary model, which was beforehand utilized in an OilRig Outer Area marketing campaign. ODAgent, OilCheck and OilBooster share related logic, and all use varied cloud service suppliers for his or her C&C communications, as do SC5k, Marlin, PowerExchange, and MrPerfectionManager.
  • Whereas not distinctive to OilRig, these downloaders have a low degree of sophistication and are sometimes unnecessarily noisy on the system, which is a observe we beforehand noticed in its Out to Sea marketing campaign.

Overview

In February 2022, we detected a brand new OilRig downloader, which we named ODAgent primarily based on its filename: ODAgent.exe. ODAgent is a C#/.NET downloader that, just like OilRig’s Marlin backdoor, makes use of the Microsoft OneDrive API for C&C communications. In contrast to Marlin, which helps a complete listing of backdoor instructions, ODAgent’s slim capabilities are restricted to downloading and executing payloads, and to exfiltrating staged recordsdata.

ODAgent was detected within the community of a producing firm in Israel – apparently, the identical group was beforehand affected by OilRig’s SC5k downloader, and later by one other new downloader, OilCheck, between April and June 2022. SC5k and OilCheck have related capabilities to ODAgent, however use cloud-based electronic mail providers for his or her C&C communications.

All through 2022, we noticed the identical sample being repeated on a number of events, with new downloaders being deployed within the networks of earlier OilRig targets: for instance, between June and August 2022, we detected the OilBooster, SC5k v1, and SC5k v2 downloaders and the Shark backdoor, all within the community of an area governmental group in Israel. Later we detected one more SC5k model (v3), within the community of an Israeli healthcare group, additionally a earlier OilRig sufferer.

SC5k is a C#/.NET utility whose goal is to obtain and execute extra OilRig instruments utilizing the Workplace Change Internet Companies (EWS) API. The brand new variations launched adjustments to make retrieval and evaluation of the malicious payloads more durable for analysts (SC5k v2), and new exfiltration performance (SC5k v3).

All of the downloaders, summarized in Determine 1, share the same logic however have completely different implementations and present rising complexity over time, alternating C#/.NET binaries with C/C++ purposes, various the cloud service suppliers misused for the C&C communication, and different specifics.

OilRig has solely used these downloaders towards a restricted variety of targets, all positioned in Israel and, in accordance with ESET telemetry, all of them have been persistently focused months earlier by different OilRig instruments. As it’s common for organizations to entry Workplace 365 assets, OilRig’s cloud service-powered downloaders can thus mix extra simply into the common stream of community site visitors – apparently additionally the rationale why the attackers selected to deploy these downloaders to a small group of particularly attention-grabbing, repeatedly victimized targets.

As of this writing, the next (completely Israeli, as famous above) organizations have been affected:

• a producing firm (SC5k v1, ODAgent, and OilCheck),
• an area governmental group (SC5k v1, OilBooster, and SC5k v2),
• a healthcare group (SC5k v3), and
• different unidentified organizations in Israel (SC5k v1).

Sadly, we don’t have details about the preliminary assault vector used to compromise the targets mentioned on this blogpost – we will’t verify whether or not the attackers have been in a position to efficiently compromise the identical organizations repeatedly, or in the event that they one way or the other managed to maintain their foothold within the community in between deploying varied instruments.

Technical evaluation

Desk 1. A abstract of most important traits of OilRig’s downloaders abusing reputable cloud service suppliers

SC5k downloader

The SampleCheck5000 (or SC5k) downloader is a C#/.NET utility, and the primary in a collection of OilRig’s light-weight downloaders that use reputable cloud providers for his or her C&C communication. We briefly documented the primary variant in our current blogpost, and have since found two newer variants.

All SC5k variants use the Microsoft Workplace EWS API to work together with a shared Change mail account, as a technique to obtain extra payloads and instructions, and to add information. Electronic mail drafts and their attachments are the first automobile for the C&C site visitors in all of the variations of this downloader, however the later variations enhance the complexity of this C&C protocol (SC5k v3) and add detection evasion capabilities (SC5k v2). This part focuses on highlighting these variations.

Change account used for C&C communication

At runtime, SC5k connects to a distant Change server by way of the EWS API to acquire extra payloads and instructions to execute from an electronic mail account shared with the attacker (and often different victims). By default, a Microsoft Workplace 365 Outlook account is accessed by way of the https://outlook.office365.com/EWS/Change.asmx URL utilizing hardcoded credentials, however some SC5k variations even have the aptitude to hook up with different distant Change servers when a configuration file is current with a hardcoded identify (setting.key, set.idl) and the corresponding credentials inside.

We’ve got seen the next electronic mail addresses utilized by SC5k variations for C&C communication, the primary of which gave the downloader its identify:

• samplecheck5000@outlook.com
• FrancesLPierce@outlook.com
• SandraRCharles@outlook.com

In SC5k v2, the default Microsoft Change URL, electronic mail handle, and password aren’t included in the primary module – as a substitute, the downloader’s code has been cut up into a number of modules. We’ve got detected solely variations of the primary utility, which logs right into a distant Change server, iterates by means of emails within the Drafts listing, and extracts extra payloads from their attachments. Nonetheless, this utility depends upon two exterior lessons that weren’t current within the detected samples and are most likely applied within the lacking module(s):

• The category init ought to present an interface to acquire the e-mail handle, username, and password required to log into the distant Change account, and different configuration values from the opposite module.
• The category construction ought to implement capabilities used for encryption, compression, executing downloaded payloads, and different helper capabilities.

These adjustments have been doubtless launched to make retrieval and evaluation of the malicious payloads more durable for analysts, as the 2 lacking lessons are essential for figuring out the Change account used for malware distribution.

C&C and exfiltration protocol

In all variations, the SC5k downloader repeatedly logs right into a distant Change server utilizing the ExchangeService .NET class within the Microsoft.Change.WebServices.Knowledge namespace to work together with the EWS API. As soon as related, SC5k reads electronic mail messages with attachments within the Drafts listing to extract attacker instructions and extra payloads. Conversely, in every connection, SC5k exfiltrates recordsdata from an area staging listing by creating new electronic mail drafts in the identical electronic mail account. The trail to the staging listing varies throughout samples.

Of curiosity is the way in which each the operators and varied cases of this downloader can distinguish between the various kinds of drafts within the shared electronic mail account. For one, every electronic mail draft has a <victimID> included, which permits the identical Change account for use for a number of OilRig victims:

• For v1 and v2, the downloader transmits the <victimID> as a customized attribute of the e-mail draft by way of the SetExtendedProperty technique.
• For v3, the downloader incorporates the <victimID> into the From subject of the e-mail draft.

The <victimID> is usually generated utilizing the compromised system’s data, such because the system quantity ID or the pc identify, as proven in Determine 2.

Moreover, varied electronic mail properties can be utilized to tell apart between messages created by the operators (instructions, extra payloads) and messages created by the malware cases (command outputs, exfiltrated recordsdata). SC5k v1 and v2 use file extensions (of the draft attachments) to make that distinction, whereas SC5k v3 makes use of the From and MailItem.Classes fields of the e-mail draft to tell apart between varied actions. At every level, the e-mail drafts within the shared electronic mail account can serve varied functions, as summarized in Desk 2 and defined beneath. Observe that the e-mail addresses used within the From subject aren’t real; as a result of SC5k by no means sends out any precise electronic mail messages, these attributes are solely used to tell apart between completely different malicious actions.

Desk 2. Sorts of electronic mail messages utilized by SC5k v3 for C&C communications

Extra particularly, SC5k v3 processes (after which deletes) these electronic mail messages from the shared Change account which have the From subject set to <victimID>@outlook.com, and distinguishes between instructions and extra payloads by the message class (MailItem.Classes):

• For payloads, the connected file is XOR decrypted utilizing the hardcoded key &5z, then gzip decompressed and dumped within the working listing.
• For shell instructions, the draft attachment is base64 decoded, XOR decrypted, after which executed domestically utilizing cmd.exe or, within the case of SC5k v3, utilizing a customized command interpreter positioned beneath the identify <baseDirectory>*Ext.dll. This file is then loaded by way of Meeting.LoadFrom, and its prolong technique invoked with the command handed as an argument.

To speak with the attackers, SC5k v3 creates draft messages with a distinct From subject: <victimID>@aol.com. Connected to those messages are outputs of beforehand acquired instructions, or contents of the native staging listing. Recordsdata are all the time gzip compressed and XOR encrypted earlier than being uploaded to the shared mailbox, whereas shell instructions and command outputs are XOR encrypted and base64 encoded.

Lastly, SC5k v3 repeatedly creates a brand new draft on the shared Change account with the From subject set to <victimID>@yahoo.com, to point to the attackers that this downloader occasion continues to be lively. This keep-alive message, whose development is proven in Determine 3, has no attachment and is renewed with every connection to the distant Change server.

Different OilRig instruments utilizing email-based C&C protocol

OilCheck, a C#/.NET downloader found in April 2022, additionally makes use of draft messages created in a shared electronic mail account for each instructions of the C&C communication. In contrast to SC5k, OilCheck makes use of the REST-based Microsoft Graph API to entry a shared Microsoft Workplace 365 Outlook electronic mail account, not the SOAP-based Microsoft Workplace EWS API. Whereas SC5k makes use of the built-in ExchangeService .NET class to create the API requests transparently, OilCheck builds the API requests manually. The principle traits of OilCheck are summarized in Desk 1 above.

Earlier in 2023, two different OilRig backdoors have been publicly documented: MrPerfectionManager (Pattern Micro, February 2023) and PowerExchange (Symantec, October 2023), each utilizing email-based C&C protocols to exfiltrate information. A notable distinction between these instruments and OilRig’s downloaders studied on this blogpost is that the previous use the victimized group’s Change server to transmit electronic mail messages from and to the attacker’s electronic mail account. In distinction: with SC5k and OilCheck, each the malware and the operator accessed the identical Change account and communicated by creating electronic mail drafts, by no means sending an precise message.

In any case, the brand new findings verify the development of OilRig shifting away from the beforehand used HTTP/DNS-based protocols to utilizing reputable cloud service suppliers as a technique to cover its malicious communication and to masks the group’s community infrastructure, whereas nonetheless experimenting with varied flavors of such different protocols.

OilBooster downloader

OilBooster is a 64-bit moveable executable (PE) written in Microsoft Visible C/C++ with statically linked OpenSSL and Increase libraries (therefore the identify). Like OilCheck, it makes use of the Microsoft Graph API to hook up with a Microsoft Workplace 365 account. In contrast to OilCheck, it makes use of this API to work together with a OneDrive (not Outlook) account managed by the attackers for C&C communication and exfiltration. OilBooster can obtain recordsdata from the distant server, execute recordsdata and shell instructions, and exfiltrate the outcomes.

Overview

Upon execution, OilBooster hides its console window (by way of the ShowWindow API) and verifies that it was executed with a command line argument; in any other case it terminates instantly.

OilBooster then builds a <victimID> by combining the compromised pc’s hostname and username: <hostname>-<username>. This identifier is later used within the C&C communication: OilBooster creates a particular subdirectory on the shared OneDrive account for every sufferer, which is then used to retailer backdoor instructions and extra payloads (uploaded by the operators), command outcomes, and exfiltrated information (uploaded by the malware). This manner, the identical OneDrive account could be shared by a number of victims.

Determine 4 reveals the construction of the shared OneDrive account and the native working listing, and summarizes the C&C protocol.

As proven in Determine 4, the OilRig operator uploads backdoor instructions and extra payloads to the victim-specific listing on OneDrive, as recordsdata with the .doc and .docx extensions, respectively. On the opposite finish of the C&C protocol, OilBooster uploads command outcomes and exfiltrated information as recordsdata with the .xls and .xlsx extensions, respectively. Observe that these aren’t real Microsoft Workplace recordsdata, however slightly JSON recordsdata with XOR-encrypted and base64-encoded values.

Determine 5 reveals OilBooster spawning cases of two threads in an indefinite loop, sleeping for 153,123 milliseconds after every iteration:

Each threads work together with the shared OneDrive account:

1. A downloader thread handles C&C communication and executes downloaded payloads.
2. An exfiltration thread exfiltrates information from the native staging listing.

The downloader thread connects to the attacker-controlled OneDrive account and iterates by means of all recordsdata with the .doc and .docx extensions, that are then downloaded, decrypted, and parsed with the intention to extract and execute extra payloads on the compromised host. An area subdirectory named gadgets within the present working listing (the place OilBooster is deployed) is used to retailer the downloaded recordsdata. As proven in Determine 6, every connection try is dealt with in a separate thread occasion, launched as soon as each 53,123 milliseconds.

The exfiltration thread iterates over one other native subdirectory, named tempFiles, and exfiltrates its contents to the shared OneDrive account, that are uploaded there as particular person recordsdata with the .xlsx extension. The staging listing is cleared this manner as soon as each 43,123 milliseconds in a separate thread occasion, as additionally seen in Determine 6.

Community communication

For C&C communication and exfiltration, OilBooster makes use of the Microsoft Graph API to entry the shared OneDrive account, utilizing quite a lot of HTTP GET, POST, PUT, and DELETE requests to the graph.microsoft.com host over the usual 443 port. For brevity, we may even refer to those requests as OneDrive API requests. The encrypted communication is facilitated by the statically linked OpenSSL library, which handles the SSL communication.

To authenticate with the OneDrive account, OilBooster first obtains the OAuth2 entry token from the Microsoft identification platform (the authorization server) by sending a POST request with the next physique over port 443 to login.microsoftonline.com/frequent/oauth2/v2.0/token, utilizing hardcoded credentials:

client_id=860b23a7-d484-481d-9fea-d3e6e129e249
&redirect_uri=https://login.reside.com/oauth20_desktop.srf
&client_secret=<redacted>
&refresh_token=<redacted>
&grant_type=refresh_token

OilBooster obtains a brand new entry token this manner, which will probably be used within the Authorization header of the next OneDrive API requests, together with a brand new refresh token. OilBooster additionally has a backup channel to request a brand new refresh token from its C&C server after 10 consecutive unsuccessful connections to the OneDrive server. As proven in Determine 7, the brand new token could be acquired by sending a easy HTTP GET request on port 80 to host1[.]com/rt.ovf (a reputable, doubtless compromised web site), which ought to be adopted by the brand new refresh token in cleartext within the HTTP response.

The assorted community connections made by OilBooster are summarized in Determine 8.

Downloader loop

Within the downloader loop, OilBooster repeatedly connects to the shared OneDrive account to acquire a listing of recordsdata with the .docx and .doc extensions within the victim-specific subdirectory named <victimID>/gadgets/ by sending an HTTP GET request over port 443 to this URL:

graph.microsoft.com/v1.0/me/drive/root:/<victimID>/gadgets:/kids?$filter=endsWith(identify,’.doc’)%20orpercent20endsWith(identify,’.docx’)&$choose=id,identify,file

If the connection shouldn’t be profitable (the HTTP_STATUS_DENIED response standing) after 10 makes an attempt, OilBooster connects to its fallback C&C server, host1[.]com/rt.ovf, to amass a brand new refresh token, as mentioned earlier.

Alternatively, if the required listing doesn’t but exist (HTTP_STATUS_NOT_FOUND), OilBooster first registers the sufferer on the shared OneDrive account by sending an HTTP POST request over port 443 to this URL: graph.microsoft.com/v1.0/me/drive/gadgets/root:/<victimID>:/kids with the JSON string {“identify”: “gadgets”,”folder”:{}} because the request physique, as proven in Determine 9. This request creates the entire listing construction <victimID>/gadgets on the similar time, which can later be utilized by the attackers to retailer instructions and extra payloads disguised as .doc and .docx recordsdata.

On subsequent connections (with HTTP_STATUS_OK), OilBooster processes these recordsdata to extract and execute payloads. OilBooster first downloads every file from the OneDrive account and deletes it from OneDrive after processing the file.

Processing .docx recordsdata

Observe the pointless creation of a number of recordsdata within the course of – that is typical for OilRig. We beforehand described the group’s noisy operations on compromised hosts in its Out to Sea marketing campaign.

Exfiltration loop

Within the exfiltration thread, OilBooster loops over the contents of the native listing named <currentdir>tempFiles, and uploads the file contents to the sufferer’s folder on the shared OneDrive account. Every file is processed on this means:

• OilBooster gzip compresses the unique file <filename>.<authentic extension> and writes the end result to a file named <filename>.<authentic extension>.xlsx in the identical listing.
• It then encrypts the compressed file utilizing an XOR cipher and .<authentic extension> as the important thing. If there isn’t a file extension, 4cx is used because the default key.

Lastly, the encrypted file is uploaded to the OneDrive account, and the native file is deleted.

ODAgent downloader: OilBooster’s precursor

ODAgent is a C#/.NET utility that makes use of the Microsoft Graph API to entry an attacker-controlled OneDrive account for C&C communication and exfiltration – briefly, ODAgent is loosely a C#/.NET precursor of OilBooster. Just like OilBooster, ODAgent repeatedly connects to the shared OneDrive account and lists the contents of the victim-specific folder to acquire extra payloads and backdoor instructions.

As proven in Determine 10, ODAgent then parses the metadata for every distant file. Subsequently, it makes use of the worth of the mimeType key related to the file to tell apart between backdoor instructions (formatted as JSON recordsdata) and encrypted payloads – that is not like OilBooster, which makes use of file extensions for that distinction. After processing a file domestically, ODAgent deletes the unique from the distant OneDrive listing by way of the OneDrive API.

If the downloaded file is a JSON file, ODAgent parses the a1 (command ID), a2 (encrypted backdoor command) and a3 (secret) arguments. It first derives the session key by XORing the offered secret with the hardcoded worth 15a49w@]. Then, it base64 decodes and XOR decrypts the backdoor command utilizing this session key. Desk 3 lists all backdoor instructions supported by ODAgent.

Desk 3. Backdoor instructions supported by ODAgent

Backdoor command	Description
odt>	Returns the trail to the present working listing.
dly><delaytime>	Configures the variety of seconds to attend after every connection to <delaytime>.
<commandline>	Executes the required <commandline> by way of the native API and returns the command output.

Different (non-JSON) recordsdata downloaded from the shared OneDrive account are recordsdata and extra payloads, each encrypted. ODAgent XOR decrypts these recordsdata with the hardcoded key 15a49w@], and drops them within the native <currentdir>o listing beneath the identical filename. If the unique file has a .c extension, its content material can be gzip decompressed (and the extension is then dropped from the filename).

On the finish of every connection, ODAgent uploads the contents of the native listing <currentdir>i to the <victimID>/i listing on the shared OneDrive account, preserving the unique filenames with the added .c extension.

Conclusion

For any inquiries about our analysis printed on WeLiveSecurity, please contact us at threatintel@eset.com.
ESET Analysis presents non-public APT intelligence studies and information feeds. For any inquiries about this service, go to the ESET Menace Intelligence web page.

IoCs

Recordsdata

Community

MITRE ATT&CK strategies

This desk was constructed utilizing model 14 of the MITRE ATT&CK framework.