ODAgent

Executive Summary

OilRig’s ODAgent is a Windows C#/.NET-based downloader used since 2022 for distributing additional malware payloads and exfiltrating staged data. It performs both ingestion of malicious binaries from C&C servers and the transmission of victim data back to attackers via HTTP(S). The operation demonstrates OilRig’s ongoing emphasis on modular, fast‑to‑deploy tools to achieve persistence, lateral movement, and intelligence gathering. Key capabilities include downloading, executing payloads, staging files for exfiltration, and using legitimate Windows components to avoid detection. Monitoring network traffic and endpoint behavior is essential to mitigate this threat.

ODAgent is a modular C#/.NET downloader that has been in active use by the OilRig threat group since at least 2022. The malware’s primary function is to contact a command‑and‑control (C&C) server, download additional malicious components—often complex payloads such as remote access trojans or credential stealers—and immediately execute them on the victim’s Windows system. Beyond payload delivery, ODAgent serves as an exfiltration facilitator. It stages data collected from compromised devices—including logs, credentials and system inventory—into a designated directory before transmitting those files back to the C&C channel over HTTP(S). This staging‑and‑exfiltration workflow enables OilRig to harvest actionable intelligence while minimizing detection risk. The use of compiled .NET code provides ODAgent with native Windows integration, obfuscated binaries, and the ability to evade simple signature‑based engines. While specific persistence or anti‑analysis techniques have not been fully documented, past observations suggest that OilRig often embeds downloader components in temporary folders, manipulates registry autostart keys, and leverages legitimate system utilities to mask malicious activity.

Key Capabilities

• Downloads additional malicious binaries from command-and-control endpoints
• Executes downloaded payloads on the local Windows machine
• Stages collected data such as logs and credentials into a specified directory
• Exfiltrates staged files back to C&C via HTTP(S) connections
• Utilizes .NET libraries for rapid development and obfuscation

ATT&CK Techniques

Recommended Actions

• Deploy network sensors to detect anomalous outbound HTTPS requests from unusual processes or executables in temporary directories
• Implement application whitelisting and enforce code integrity checks for critical Windows binaries
• Use endpoint detection and response (EDR) tools to monitor suspicious file creation, execution, and data staging activities
• Block known ODAgent URLs or IP addresses identified by threat intelligence sources
• Maintain up-to-date signatures and heuristics that recognize .NET downloader patterns

Suggested Tags