Samplecheck5000

SampleCheck5000 (SC5k) is a malicious software, or malware, developed as a lightweight downloader by OilRig. This malware is notable for its use of legitimate cloud service APIs such as Microsoft Graph OneDrive, Outlook, and the Office Exchange Web Services (EWS) for command and control (C&C) communication and data exfiltration. The malware, which is a C#/.NET application, represents the first in a series of downloaders developed by OilRig that exploit legitimate cloud services for their C&C operations. In the Outer Space campaign, OilRig utilized a simple yet previously undocumented C#/.NET backdoor named Solar, alongside a new downloader, SampleCheck5000 (SC5k). SC5k specifically uses the Microsoft Office Exchange Web Services API for C&C communication. This innovative use of legitimate APIs makes the malware difficult to detect and block, as it blends in with regular network traffic. The primary function of SampleCheck5000 (SC5k) is to download and execute additional OilRig tools. It achieves this by creating draft messages in the compromised email account and hiding backdoor commands within these drafts. This sophisticated method of operation allows SC5k to remain undetected while carrying out its harmful activities, making it a significant threat to cybersecurity.