Sc5k

SC5k is a malware developed by OilRig, first discovered in November 2021 during the group's Outer Space campaign. This malicious software acts as a vehicle to deploy a downloader called SampleCheck5000 (SC5k), which utilizes the Office Exchange Web Services (EWS) API to download additional tools for execution and a utility named MKG to exfiltrate data from the Chrome web browser. Throughout 2022, OilRig actively developed and used a series of similar logic downloaders such as ODAgent, OilCheck, and OilBooster, along with newer versions of SC5k. The evolution of SC5k from version 1 to version 3 shows a natural progression, with each version introducing new functionalities. The initial versions, SC5k v1 and v2, used cmd.exe to execute commands on compromised hosts. However, the later versions, SC5k v3 and OilCheck, employed custom command interpreters for executing files and commands on the infected system. Notably, SC5k and OilCheck both exfiltrated data to shared Exchange and Outlook accounts, communicating via email drafts instead of sending actual messages. These downloaders show similarities with MrPerfectionManager and PowerExchange backdoors, other recent additions to OilRig’s toolset that use email-based C&C protocols. However, unlike these backdoors, SC5k, OilBooster, ODAgent, and OilCheck utilize attacker-controlled cloud service accounts rather than the victim's internal infrastructure. Based on these indicators, there is high confidence in attributing SC5k (v1-v3), ODAgent, OilCheck, and OilBooster downloaders to OilRig.