Raspberry Robin Returns: New Malware Campaign Spreading Through WSF Files

Cybersecurity researchers have found out a new Raspberry Robin campaign wave that propagates the malware by destructive Windows Script Information (WSFs) considering that March 2024.

“Traditionally, Raspberry Robin was known to spread as a result of detachable media like USB drives, but in excess of time its distributors have experimented with other original infection vectors,” HP Wolf Security researcher Patrick Schläpfer reported in a report shared with The Hacker Information.

Raspberry Robin, also known as QNAP worm, was initially spotted in September 2021 that has given that progressed into a downloader for many other payloads in new decades, these types of as SocGholish, Cobalt Strike, IcedID, BumbleBee, and TrueBot, and also serving as a precursor for ransomware.

When the malware was to begin with distributed by implies of USB devices that contains LNK data files that retrieved the payload from a compromised QNAP gadget, it has considering that adopted other techniques such as social engineering and malvertising.

It really is attributed to an rising menace cluster tracked by Microsoft as Storm-0856, which has hyperlinks to the broader cybercrime ecosystem comprising teams like Evil Corp, Silence, and TA505.

The most recent distribution vector entails the use of WSF data files that are presented for obtain by way of various domains and subdomains.

It’s at this time not very clear how the attackers are directing victims to these URLs, while it truly is suspected that it could be both by means of spam or malvertising strategies.

The heavily obfuscated WSF file functions as a downloader to retrieve the primary DLL payload from a distant server working with the curl command, but not in advance of a series of anti-analysis and anti-virtual machine evaluations are carried out to figure out if it really is getting run in a virtualized surroundings.

It truly is also developed to terminate the execution if the make quantity of the Windows running procedure is reduced than 17063 (which was unveiled in December 2017) and if the listing of running processes incorporates antivirus processes involved with Avast, Avira, Bitdefender, Check out Position, ESET, and Kaspersky.

What is extra, it configures Microsoft Defender Antivirus exclusion policies in an effort to sidestep detection by introducing the total main push to the exclusion list and blocking it from getting scanned.

“The scripts alone are at the moment not classified as destructive by any an-virus scanners on VirusTotal, demonstrating the evasiveness of the malware and the risk of it leading to a serious an infection with Raspberry Robin,” HP mentioned.

“The WSF downloader is heavily obfuscated and employs lots of an-assessment tactics enabling the malware to evade detection and sluggish down examination.”

Observed this article interesting? Observe us on Twitter  and LinkedIn to browse far more distinctive information we post.

Some parts of this article are sourced from:
thehackernews.com