H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

ODAgent

[ODAgent](https://attack.mitre.org/software/S1170) is a C#/.NET downloader that has been used by [OilRig](https://attack.mitre.org/groups/G0049) since at least 2022 including against target organizations in Israel to download and execute payloads and to exfiltrate staged files.(Citation: ESET OilRig Downloaders DEC 2023)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[ODAgent](https://attack.mitre.org/software/S1170) is a C#/.NET downloader that has been used by [OilRig](https://attack.mitre.org/groups/G0049) since at least 2022 including against target organizations in Israel to download and execute payloads and to exfiltrate staged files.(Citation: ESET OilRig Downloaders DEC 2023)

Labels

malware
10 recorded

Relationships

uses
to Bidirectional Communication
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Exfiltration Over C2 Channel
Technique
uses
to Exfiltration to Cloud Storage
Technique
uses
to File and Directory Discovery
Technique
uses
to File Deletion
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Native API
Technique
uses
to Windows Command Shell
Technique
uses
from OilRig
Group
2 external

References

mitre-attack
S1170
open
ESET OilRig Downloaders DEC 2023
https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance