Raspberry RobinMalware
- link_msiexec
- qnap-worm
- raspberryrobin
Worm spread by external drives that leverages Windows Installer to reach out to QNAP-associated domains and download a malicious DLL.From MISP Galaxy
Last reported 3 years ago, by Huntress1 report
What the reports say
1 report, newest first · the exact sentence from each-
Evolution of USB-Borne Malware, Raspberry Robin“Evolution of USB-Borne Malware, Raspberry Robin”
Indicators in its reports
named in the reports above- hxxp://5g7[.]at:8080/y8yNq/iZR/whjn/Ax6q80a/Y1Z5/j/fs/VTSAO?xxxxin 1 report
- 5g7[.]atin 1 report
- hxxp://fxb[.]tw:8080/AMBG/9FlMJgrIkRjJfVw2bWSju/Machine=Userin 1 report
- fxb[.]twin 1 report
- hxxp://ejk[.]bz:8080/BC/A3Y7fxb0oDMXkstfQGYd/Machine?Userin 1 report
- ejk[.]bzin 1 report
- hxxp://jrx[.]fr:8080/yKyC/bSis/yUp0OSNBN0eTTIjpK/Machine=Userin 1 report
- jrx[.]frin 1 report
- hxxp://zjc[.]bz:8080/AoA3LSHNJCaFIM/hMgkh/62oyni/in 1 report
- zjc[.]bzin 1 report
- hxxp://zjc[.]bz:8080in 1 report
Copy these 11 indicators · defanged
Thanks — we review every report.