On September 24, 2018, we observed an organization targeted by OilRig attempting to download a Zip archive from the following URL: hxxp://193.111.152[.]13/[redacted]-ITsoftwareUpdate.zip This Zip archive contained a file named [redacted]-ITsoftwareUpdate.exe (SHA256: 5f42deb792d8d6f347c58ddbf634a673b3e870ed9977fdd88760e38088cd7336), which is a variant of the OopsIE Trojan we described in detail in a blog we published in September 2018