Full Report
A deep dive into the USB-borne Raspberry Robin malware and how Huntress Managed EDR and Managed Antivirus can detect and mitigate this threat.
Analysis Summary
# Tool/Technique: Raspberry Robin
## Overview
Raspberry Robin is a highly sophisticated "USB worm" that primarily spreads through infected removable storage devices. While it functions as a worm in its delivery method, it is widely recognized as a modular loader and a key component of a larger cybercrime ecosystem. It often serves as a precursor for high-impact follow-on attacks, including the deployment of SocGholish, Cobalt Strike, and various ransomware variants (such as IcedID or INC Ransom).
## Technical Details
- **Type:** Malware family (Worm / Loader)
- **Platform:** Windows
- **Capabilities:** Persistence, evasion, MSI installer abuse, command-and-control (C2) communication, and delivery of secondary payloads.
- **First Seen:** Approximately September 2021 (Huntress observations cited from July 2022 onwards).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1091 - Replication Through Removable Media]
- **[TA0002 - Execution]**
- [T1204.002 - User Execution: Malicious File] (LNK files)
- [T1218.005 - System Binary Proxy Execution: Msiexec]
- **[TA0003 - Persistence]**
- [T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder]
- **[TA0005 - Defense Evasion]**
- [T1112 - Modify Registry] (Renaming keys to evade detection)
- [T1564 - Hide Artifacts] (Use of "junk" files and obfuscated commands)
## Functionality
### Core Capabilities
- **USB Propagation:** Leverages infected USB drives containing malicious `.LNK` files that point to hidden or obfuscated "junk" files on the drive.
- **MSIExec Abuse:** Uses the legitimate Windows Installer (`msiexec.exe`) to fetch and execute malicious payloads from remote C2 servers via the internet.
- **Registry Persistence:** Establishes a foothold by creating values under the `RunOnce` registry key, ensuring the malware executes upon user login.
### Advanced Features
- **Registry Evasion:** Temporarily renames the `RunOnce` registry key when writing to it to bypass security monitoring tools that specifically watch that key for changes.
- **Self-Healing Persistence:** Raspberry Robin re-adds its `RunOnce` value every time it runs, as the standard Windows behavior for `RunOnce` is to delete the entry after execution.
- **Obfuscated Commands:** Utilizes highly obfuscated command strings within LNK files, often including heavy use of case-randomization and "junk" characters to bypass static signature detection.
## Indicators of Compromise
- **File Names:** Windows shortcut files (`.LNK`) on USB devices; `.cfg` or other non-standard extensions for script/command files.
- **Registry Keys:** `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce` (or variations where the key name is briefly altered).
- **Network Indicators (Defanged):**
- `hTTP[:]//FxB[.]tw:8080`
- `hTTP[:]//eJK[.]bz:8080`
- `hTTP[:]//jRx[.]fr:8080`
- `hTTp[:]//ZjC[.]bz:8080`
- **Behavioral Indicators:** `msiexec.exe` making outbound network connections to non-standard ports (e.g., 8080) or downloading files from unfamiliar domains via the CLI.
## Associated Threat Actors
- **INC Ransom group** (observed in associated activity)
- **Evil Corp / TA505** (linked by external research to the broader ecosystem)
- **UNC2452** (linked to elements of the delivery infrastructure)
## Detection Methods
- **Behavioral Detection:** Monitoring for `msiexec.exe` processes launched with remote URL arguments, particularly those involving non-standard ports or obfuscated command lines.
- **Registry Monitoring:** Detecting the renaming of the `RunOnce` registry key or rapid creation/deletion cycles of values within that key.
- **Hardware Telemetry:** Identifying specific USB hardware IDs (e.g., `USB\VID_13FE&PID_6300`) associated with known infected batches.
## Mitigation Strategies
- **Prevention Measures:** Disable AutoRun/AutoPlay for all removable drives via Group Policy.
- **Hardening:** Implement "Attack Surface Reduction" (ASR) rules, specifically those blocking the execution of potentially obfuscated scripts and preventing `msiexec.exe` from launching processes from downloaded files.
- **USB Access Control:** Restrict the use of unauthorized USB devices across the organization.
## Related Tools/Techniques
- **SocGholish:** Often seen as a follow-on stage.
- **Cobalt Strike:** Used for lateral movement post-infection.
- **LNK File Abuse:** A common technique for initial execution in similar worms.