H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[OilBooster](https://attack.mitre.org/software/S1172) is a downloader written in Microsoft Visual C/C++ that has been used by [OilRig](https://attack.mitre.org/groups/G0049) since at least 2022 including against target organizations in Israel to download and execute files and for exfiltration.(Citation: ESET OilRig Downloaders DEC 2023)

Labels

malware

16 recorded

Relationships

uses

to Asymmetric Cryptography

Technique

uses

to Bidirectional Communication

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Exfiltration to Cloud Storage

Technique

uses

to Fallback Channels

Technique

uses

to Hidden Window

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Inter-Process Communication

Technique

uses

to Local Data Staging

Technique

uses

Technique

uses

to System Information Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

uses

Group

2 external

References

mitre-attack

S1172

ESET OilRig Downloaders DEC 2023

https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/