TF-MAL-ps1.oilrig
📛 Threat Title
Malware family: OilRig
Description
ThreatFox malware family `ps1.oilrig`. Printable name: OilRig.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
ps1.oilrig
VT: VT base fetch failed: HTTPError: 429 Too Many Requests for domains/ps1.oilrig
IOC database
- Type
- domain
- Value
ps1.oilrig- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-ps1.oilrig
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Too Many Requests for domains/ps1.oilrig
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:attackevals.github.io
This scenario follows OilRig's multi-phase approach to exfiltrating sensitive data from a targeted server. OilRig leverages spearphishing to gain initial access onto an administrator's workstation and deploys their SideTwist malware .
-
web:attack.mitre.org
OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications.
-
web:cybergirlie.substack.com
APT34, also known as OilRig , is a well-documented Iranian threat actor group that has consistently targeted organizations in the financial, energy, telecom, and government sectors. Their operations are marked by advanced spearphishing campaigns, custom malware families, and a strong emphasis on credential theft and persistence. This article documents their tactics, techniques, and procedures ...
-
web:cyberpress.org
A newly discovered cyberespionage campaign by the Iranian state-sponsored group APT-C-49, also known as OilRig or APT34, has revealed a highly sophisticated attack chain that hides malicious configurations inside seemingly harmless images hosted on Google Drive. Using recent Iranian protests as a phishing lure, the threat actors have deployed an advanced multi-stage malware designed to evade ...
-
web:cybersecsentinel.com
Endpoint Detection: Deploy EDR solutions to detect and block file hashes associated with OilRig's malware , such as STEALHOOK, Menorah, and DULLOAD. Privilege Management: Restrict access to critical systems and ensure that least-privilege principles are applied to minimize the impact of successful exploits.
-
web:cybersecuritynews.com
The Iranian state-sponsored hacking group OilRig , also known as APT34, has intensified its cyber espionage activities, targeting critical infrastructure and government entities in the United Arab Emirates and the broader Gulf region.
-
web:knowledgehubmedia.com
The LogRhythm Labs team provides actionable intelligence detailing the Tools, Techniques, and Procedures (TTPs) threat actors use in this in-depth report.Use this information—combined with mitigation and remediation strategies presented in this report—to respond to network attacks by this threat actor. In addition, LogRhythm SmartResponse™ plug-ins will assist in your response efforts if ...
-
web:radar.certfa.com
OilRig's targeting reflects MOIS priorities for regional intelligence collection, including monitoring of Saudi Arabian and Gulf state government activities and strategic energy sector intelligence. Tooling and Tactics OilRig is known for its extensive and continuously evolving custom malware toolkit.
-
web:www.picussecurity.com
Discover the tools, techniques, and tactics of OilRig (APT34), a state-sponsored cyber threat group targeting critical sectors in the Middle East.
-
web:www.securityscientist.net
OilRig (APT34/G0049) is an Iranian state-sponsored APT active since 2014. Learn their DNS tunneling C2, custom malware families, notable campaigns, and how to detect them.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.