S1168: SampleCheck5000
SampleCheck5000 is a downloader with multiple variants that was used by OilRig including during the Outer Space campaign to download and execute additional payloads. CitationESET OilRig Campaigns Sep 2023CitationESET OilRig Downloaders DEC 2023
Security context for executives and security teams
SampleCheck5000 matters because ATT&CK describes it as a Windows downloader used to retrieve and execute additional payloads. For leaders, the risk is not the downloader alone; it is the follow-on access it can enable, including command execution, tool transfer, discovery, staging, archiving, and possible exfiltration over web services based on ATT&CK relationships.
Executive priority
Prioritize this as a validation point for Windows endpoint visibility, outbound web traffic governance, and incident response readiness. The ATT&CK relationships connect SampleCheck5000 to OilRig and the Outer Space campaign, including targeting of Israeli organizations in that campaign, but local exposure depends on your environment and telemetry. Executives should ask whether SOC teams can prove detection and investigation coverage for downloader behavior, legitimate-looking web service communications, and rapid follow-on payload execution.
Technical view
For SOC, detection engineering, and IR teams, validate coverage around the related techniques: Windows Command Shell execution, web-protocol command and control, bidirectional communication through external web services, ingress tool transfer, deobfuscation or decoding, system and local storage discovery, local staging, archive creation, and exfiltration over web services. Because ATT&CK provides no official detection text for this malware object, teams should build coverage from the mapped behaviors rather than from the malware name alone.
Likely telemetry
- Windows endpoint process creation and command-line telemetry, especially cmd.exe and child-process relationships
- File creation and modification events for downloaded payloads, staged data, decoded content, and archives
- Network telemetry for outbound HTTP/S or other web-protocol traffic from Windows hosts
- Proxy, DNS, firewall, and TLS metadata for unusual external web service communication patterns
- EDR alerts or behavioral logs for tool transfer, payload execution, and suspicious archive utility usage
Detection direction
- Do not rely only on signatures for SampleCheck5000; ATT&CK notes multiple variants and provides no official detection guidance.
- Correlate outbound web traffic with new file writes and subsequent process execution on Windows endpoints.
- Tune for suspicious Windows command shell use where it is linked to downloads, decoding, staging, archiving, or discovery activity.
- Review allowlisted cloud or web services carefully, because related ATT&CK techniques include bidirectional communication and exfiltration over web services.
- Account for false positives from legitimate software deployment, administration scripts, backup tools, compression utilities, and normal cloud service usage.
Mitigation priorities
- Confirm endpoint logging and EDR coverage on Windows systems before attempting malware-specific detection engineering.
- Restrict and monitor unnecessary outbound web access, especially from servers and sensitive workstations.
- Apply least privilege and application control where feasible to reduce unauthorized command shell execution, payload execution, and archive utility abuse.
- Harden egress controls and web proxy inspection policies for unapproved web services while preserving business-required access.
- Prepare IR playbooks for downloader cases that include scoping follow-on payloads, reviewing external communications, and searching for staged or archived data.
Additional notes and limits
ATT&CK identifies SampleCheck5000 as a downloader used by OilRig, including during the Outer Space campaign, and maps it to behaviors spanning execution, command and control, discovery, collection, and exfiltration-related techniques. The most useful defensive approach is behavior-led validation across endpoint, network, and web-service telemetry.
The supplied ATT&CK object has no official detection section, no aliases, and no object-level tactics. The malware platform is listed as Windows, while several related techniques have broader ATT&CK platform listings; environment-specific validation is required before asserting coverage or exposure.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
SampleCheck5000
SampleCheck5000 is a downloader with multiple variants that was used by OilRig including during the Outer Space campaign to download and execute additional payloads. CitationESET OilRig Campaigns Sep 2023CitationESET OilRig Downloaders DEC 2023
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.