OilCheck — Malware Profile

OilCheck is a C#/.NET downloader that has been used by OilRig since at least 2022 including against targets in Israel. OilCheck uses draft messages created in a shared email account for C2 communication.

MITRE ATT&CK techniques (3)

• T1102.002 Bidirectional Communication
• T1105 Ingress Tool Transfer
• T1567 Exfiltration Over Web Service

Attributed threat actors

• OilRig

Read the full analysis on IntelFusions