Managed XDR

vtdl_ahijmuip (Raspberry Robin ) — malware analysis report

File info

Filename
vtdl_ahijmuip
File type
MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has command line arguments, Icon number=-33, Archive, ctime=Sun Nov 21 03:24:03 2010, mtime=Sun Nov 21 03:24:03 2010, atime=Sun Nov 21 03:24:03 2010, length=302592, window=hidenormalshowminimized
File size
1.8 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
22d8b5f576ce7e4a4f690409593039b61dbf62a8
SHA256
29597552ddd87bf7d793d0569509acdba86104afdf23c6b9eb44ca3215187451
MD5
d2a79de3b98ffe0228fcb3519afd610f

Malwares

  • Raspberry Robin

Signatures

Execution

T1204 suspicious_lnk: LNK file with suspicious content
T1059.003 suspicious_cmd: Executes cmd.exe with a suspicious command line

Defense Evasion

T1027 suspicious_cmd: Executes cmd.exe with a suspicious command line

Discovery

T1082 recon_url_beacon: Sends information about the computer over the network using URL
T1033 recon_url_beacon: Sends information about the computer over the network using URL

Command and Control

T1071.001 recon_url_beacon: Sends information about the computer over the network using URL
T1071.001 network_http: Performs HTTP requests
T1071.001 winhttp_https: Performs HTTP/HTTPS requests using WinHttp

Other

suricata_alert: Malicious traffic detected
suspicious_process_network: Unusual process network activity detected
unexpected_exception: Unexpected exception
no_graphical_activity: No graphic activity
creates_suspended_process: Creates suspended process
test_check_service: Starts services
yara_rules: Static rules

Related reports