Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Oil Rig Actors Provide a Glimpse into Development and Testing Efforts

Summary: Unit 42 observed OilRig actors uploading ClaySlide delivery documents to a public antivirus testing site, making subtle code changes, and re-uploading to see which vendors still detected them, in two sessions: 17 iterations over two hours on June 15, 2016, and six iterations within 30 minutes on November 15, 2016. In the June session the actor removed the payload-saving and scheduled-task code to reach a zero detection rate, then modified commands, encodings, and function names, while the November files kept their Helminth payload using the C2 domain updateorg[.]com and ended at a detection rate of 2.

What's compelling: The group iterated 17 times in a single two-hour window and stopped only when detections hit zero, so a signature that catches one ClaySlide sample may not catch the next build from the same actor.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related