Raspberry Robin Malware

A newly detailed threat has been out in the wild since late 2021. The malware has wormlike capabilities and is called Raspberry Robin.

Raspberry Robin is classified as wormable malware. A wormable threat has capabilities that allow it to spread without direct human control and intervention.

The threat was examined and analyzed by researchers with security firm Red Canary Intelligence. Raspberry Robin was first spotted in the autumn of 2021. The malware uses USB flash memory drives to spread and infect Windows-based machines. Raspberry Robin uses Microsoft Standard Installer .msi files and other valid and legitimate processes to drop malicious files onto the target system.

Once deployed on the victim system, Raspberry Robin makes use of the msiexec command to connect to its infrastructure, sending out the victim device and user name. The worm-like malware also installs a malicious DLL on the compromised system.

There are still some unanswered questions surrounding Raspberry Robin. Researchers are not sure how exactly the worm propagates into the flash drives it uses as carriers and whether this happens offline. The purpose of the dropped malicious DLL file is also not certain, even though researchers suspect it is used for establishing persistence on the host machine.

The end goal of the threat actor running Raspberry Robin's infrastructure is also not clear, as researchers have been unable to examine and monitor the malware's activity at later stages of its activity.

The worm plants a .lnk shortcut on the infected flash drive, which is made to look like a normal folder. Raspberry Robin used the Windows command line tool cmd.exe to execute a file stored on the USB flash drive. Another characteristic feature of the malware is the use of mixed upper and lowercase letters in the spelling of its commands, possibly as a further attempt to dodge automated detection.

The malware uses msiexec and rundll32 to execute malicious commands. Those are used to launch and then further configure the malicious DLL file described above.