H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

SampleCheck5000

[SampleCheck5000](https://attack.mitre.org/software/S1168) is a downloader with multiple variants that was used by [OilRig](https://attack.mitre.org/groups/G0049) including during the [Outer Space](https://attack.mitre.org/campaigns/C0042) campaign to download and execute additional payloads. (Citation: ESET OilRig Campaigns Sep 2023)(Citation: ESET OilRig Downloaders DEC 2023)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[SampleCheck5000](https://attack.mitre.org/software/S1168) is a downloader with multiple variants that was used by [OilRig](https://attack.mitre.org/groups/G0049) including during the [Outer Space](https://attack.mitre.org/campaigns/C0042) campaign to download and execute additional payloads. (Citation: ESET OilRig Campaigns Sep 2023)(Citation: ESET OilRig Downloaders DEC 2023)

Labels

malware
12 recorded

Relationships

uses
from OilRig
Group
uses
from Outer Space
Campaign
uses
to Archive via Utility
Technique
uses
to Bidirectional Communication
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Exfiltration Over Web Service
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Local Data Staging
Technique
uses
to Local Storage Discovery
Technique
uses
to System Information Discovery
Technique
uses
to Web Protocols
Technique
uses
to Windows Command Shell
Technique
4 external

References

mitre-attack
S1168
open
SC5k
—
ESET OilRig Downloaders DEC 2023
https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/
open
ESET OilRig Campaigns Sep 2023
https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance