H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

ISMInjector

[ISMInjector](https://attack.mitre.org/software/S0189) is a Trojan used to install another [OilRig](https://attack.mitre.org/groups/G0049) backdoor, ISMAgent. (Citation: OilRig New Delivery Oct 2017)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[ISMInjector](https://attack.mitre.org/software/S0189) is a Trojan used to install another [OilRig](https://attack.mitre.org/groups/G0049) backdoor, ISMAgent. (Citation: OilRig New Delivery Oct 2017)

Labels

malware
5 recorded

Relationships

uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Obfuscated Files or Information
Technique
uses
to Process Hollowing
Technique
uses
to Scheduled Task
Technique
uses
from OilRig
Group
3 external

References

mitre-attack
S0189
open
ISMInjector
—
OilRig New Delivery Oct 2017
https://researchcenter.paloaltonetworks.com/2017/10/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance