Raspberry Robin Adopts Unique Evasion Techniques

Danger actors relying on the Raspberry Robin malware have been noticed adopting special evasion tactics to keep away from detection.

Security scientists at Test Point Investigation (CPR) released a new advisory on Tuesday describing the novel malware features and how defenders can guard methods versus them.

“Anti-debugging and other evasions can be exhausting, and even more so when it comes to these obfuscation strategies and volume of procedures as Raspberry Robin implements,” wrote CPR security researcher Shavit Yosef. “This exploration aims to exhibit plenty of solutions with explanations of how they get the job done and how to evade those people evasions.”

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

Examine a lot more on the Raspberry Robin malware: Raspberry Robin Worm Actors Linked to Clop, LockBit Ransomware Teams

A number of of the new solutions Raspberry Robin utilizes are relevant to its capacity to prevent staying operate on digital equipment (VMs), which security scientists typically use to analyze malware. This would make it more difficult for defenders to analyze the resource. Technical information to protect against them are out there in the advisory.

Raspberry Robin also included other evasion tactics at numerous levels of its procedure. CPR analyzed two new exploits the malware made use of to acquire increased privileges on contaminated programs. 

The 1st of them (CVE-2020-1054) requires benefit of a bug in the win32k window item, allowing for it to write knowledge outside of its supposed boundaries. The exploit is only employed by Raspberry Robin on Windows 7 units.

The second exploit (CVE-2021-1732) is similar from a technological standpoint but targets Windows 10 units with specific create figures and checks if a particular patch is current. Yosef wrote that this exploit was employed in the earlier as a zero-working day by the Bitter APT group. 

“Raspberry Robin applied other great methods and exploits demonstrating that he also has capabilities in the exploiting location,” the security researcher added. “Unfortunately, the world of evasions is only having tougher and additional resourceful, so buckle up and pray that any individual presently encountered this evasion before you.”