Malware: RogueRobin

Description

[RogueRobin](https://attack.mitre.org/software/S0270) is a payload used by [DarkHydrus](https://attack.mitre.org/groups/G0079) that has been developed in PowerShell and C#. (Citation: Unit 42 DarkHydrus July 2018)(Citation: Unit42 DarkHydrus Jan 2019)

External References

• mitre-attack
• Unit 42 DarkHydrus July 2018
• Unit42 DarkHydrus Jan 2019

Techniques Used by This Malware

• T1016 — System Network Configuration Discovery
• T1027.010 — Command Obfuscation
• T1033 — System Owner/User Discovery
• T1047 — Windows Management Instrumentation
• T1057 — Process Discovery
• T1059.001 — PowerShell
• T1059.003 — Windows Command Shell
• T1082 — System Information Discovery
• T1102.002 — Bidirectional Communication
• T1105 — Ingress Tool Transfer
• T1113 — Screen Capture
• T1132.001 — Standard Encoding
• T1140 — Deobfuscate/Decode Files or Information
• T1218.010 — Regsvr32
• T1497.001 — System Checks
• T1518.001 — Security Software Discovery
• T1547.001 — Registry Run Keys / Startup Folder
• T1547.009 — Shortcut Modification

APT Groups Using This Malware

• DarkHydrus