ThaiCERT    ETDA    MDES
Report
Search
Home > List all groups > List all tools > List all groups using tool RogueRobin

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Tool: RogueRobin

NamesRogueRobin
RogueRobinNET
CategoryMalware
TypeReconnaissance, Backdoor, Info stealer, Exfiltration, Tunneling
Description(Palo Alto) In our original blog on DarkHydrus, we analyzed a PowerShell-based payload we named RogueRobin. While performing the analysis on the delivery documents using the .sct file AppLocker bypass, we noticed the C# payload was functionally similar to the original RogueRobin payload. The similarities between the PowerShell and C# variants of RogueRobin suggests that the DarkHydrus group ported their code to a compiled variant.

The C# variant of RogueRobin attempts to detect if it is executing in a sandbox environment using the same commands as in the PowerShell variant of RogueRobin. The series of commands, as seen in Table 2, include checks for virtualized environments, low memory, and processor counts, in addition to checks for common analysis tools running on the system. The Trojan also checks to see if a debugger is attached to its processes and will exit if it detects the presence of a debugger.
Information<https://unit42.paloaltonetworks.com/darkhydrus-delivers-new-trojan-that-can-use-google-drive-for-c2-communications/>
<https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/>
MITRE ATT&CK<https://attack.mitre.org/software/S0270/>
Malpedia<https://malpedia.caad.fkie.fraunhofer.de/details/ps1.roguerobin>
<https://malpedia.caad.fkie.fraunhofer.de/details/win.roguerobin>
AlienVault OTX<https://otx.alienvault.com/browse/pulses?q=tag:RogueRobin>

Last change to this tool card: 13 May 2020

Download this tool card in JSON format

Previous: RockLoader
Next: RokRAT

All groups using tool RogueRobin

ChangedNameCountryObserved

APT groups

 DarkHydrus, LazyMeerkatIran2016-Jan 2019 

1 group listed (1 APT, 0 other, 0 unknown)

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
E-mail report@thaicert.or.th
PGP Download PGP key