Samplecheck5000 Sc5k

SampleCheck5000 (SC5k) is a vulnerability in software design or implementation, used by the threat group OilRig, also known as APT34, Helix Kitten, Cobalt Gypsym, Lyceum, Crambus, or Siamesekitten. This group has been linked to potential Iranian threat actors and is notorious for its sophisticated cyberattacks. In their most recent activities, they deployed four specific new downloaders, including SC5k v1-v3, ODAgent, OilCheck, and OilBooster. These lightweight downloaders are unique due to their use of legitimate cloud service APIs such as Microsoft Graph OneDrive, Outlook APIs, and the Microsoft Office Exchange Web Services (EWS) API for Command & Control (C&C) communication and data exfiltration. Post-compromise, OilRig uses a variety of tools, including the SampleCheck5000 (SC5k) downloader, browser-data dumpers, and Windows Credential Manager stealers. These tools enable the group to advance from Solar to Mango with backdoor-like implants, indicating an evolution in their attack techniques. The introduction of these new downloaders in the last year represents a significant addition to OilRig's already substantial arsenal of custom malware. This information was revealed by ESET researchers in a blog post published on December 14th. The deployment of these new downloaders, particularly SampleCheck5000 (SC5k), underscores the escalating threat posed by the OilRig group. It is crucial for organizations to understand these vulnerabilities and implement necessary security measures to mitigate potential risks associated with these advanced persistent threats.