RogueRobin
Description
(Palo Alto) In our original blog on DarkHydrus, we analyzed a PowerShell-based payload we named RogueRobin. While performing the analysis on the delivery documents using the .sct file AppLocker bypass, we noticed the C# payload was functionally similar to the original RogueRobin payload. The similarities between the PowerShell and C# variants of RogueRobin suggests that the DarkHydrus group ported their code to a compiled variant.
The C# variant of RogueRobin attempts to detect if it is executing in a sandbox environment using the same commands as in the PowerShell variant of RogueRobin. The series of commands, as seen in Table 2, include checks for virtualized environments, low memory, and processor counts, in addition to checks for common analysis tools running on the system. The Trojan also checks to see if a debugger is attached to its processes and will exit if it detects the presence of a debugger.
Names
| Name |
|---|
| RogueRobin |
| RogueRobinNET |
Category
Malware
Type
- Reconnaissance
- Backdoor
- Info stealer
- Exfiltration
- Tunneling
Information
- https://unit42.paloaltonetworks.com/darkhydrus-delivers-new-trojan-that-can-use-google-drive-for-c2-communications/
- https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/
Mitre Attack
Malpedia
- https://malpedia.caad.fkie.fraunhofer.de/details/ps1.roguerobin
- https://malpedia.caad.fkie.fraunhofer.de/details/win.roguerobin
Alienvault Otx
Other Information
Uuid
87ad16c6-a771-4f89-bdd3-c5e2ad4f3354
Last Card Change
2020-05-13