# Raspberry Robin: Highly Evasive Worm Spreads over External Disks **[blogs.cisco.com/security/raspberry-robin-highly-evasive-worm-spreads-over-external-disks](https://blogs.cisco.com/security/raspberry-robin-highly-evasive-worm-spreads-over-external-disks)** Onur Mustafa Erdogan August 9, 2022 ## Introduction During our threat hunting exercises in recent months, we’ve started to observe a distinguishing pattern of msiexec.exe usage across different endpoints. As we drilled down to individual assets, we found traces of a recently discovered malware called Raspberry Robin. The RedCanary Research Team first coined the name for this malware in their blog post, and Sekoia published a Flash Report about the activity under the name of QNAP Worm. Both articles offer great analysis of the malware’s behavior. Our findings support and enrich prior research on the topic. ## Execution Chain Raspberry Robin is a worm that spreads over an external drive. After initial infection, it downloads its payload through msiexec.exe from QNAP cloud accounts, executes its code through rundll32.exe, and establishes a command and control (C2) channel through TOR connections. ----- Image 1: Execution chain of Raspberry Robin Let’s walkthrough the steps of the kill-chain to see how this malware functions. ## Delivery and Exploitation Raspberry Robin is delivered through infected external disks. Once attached, cmd.exe tries to execute commands from a file within that disk. This file is either a .lnk file or a file with a specific naming pattern. Files with this pattern exhibit a 2 to 5 character name with an usually obscure extension, including .swy, .chk, .ico, .usb, .xml, and .cfg. Also, the attacker uses an excessive amount of whitespace/non printable characters and changing letter case to avoid string matching detection techniques. Example command lines include: C:\Windows\System32\cmd.exe [redacted whitespace/non printable characters] /RCmD